Vendor
Toptech Systems
11 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
Critical 9.0
Toptech TMS7 and TopHAT SQL Injection
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.
-
Critical 9.0
Toptech TMS7 and TopHAT SQL Injection
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.
-
Critical 9.0
Toptech TMS7 and TopHAT SQL Injection
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.
-
Critical 9.0
Toptech TMS7 and TopHAT SQL Injection
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.
-
Critical 9.0
Toptech TMS7 and TopHAT SQL Injection
The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.
-
Critical 9.1
Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
-
Critical 10.0
Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.