Tcman Gim vulnerabilities

CVE-2025-41012 [MEDIUM] CWE-862 CVE-2025-41012: Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an un Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword' parameters with 'soapaction UnlockUser’ in '/WS/PDAWebService.asmx'.

CVE-2022-36277 [MEDIUM] CWE-79 CVE-2022-36277: The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionSto The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks.

CVE-2021-40852 [MEDIUM] CWE-601 CVE-2021-40852: TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection o TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information.

CVE-2021-4046 [MEDIUM] CWE-79 CVE-2021-4046: The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XS The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data.