CVE-2025-40668
Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.
Vendor
Product
CWE
Yayın Tarihi
2025-06-09 13:15:22
Güncelleme
2025-10-06 19:48:50
Source Identifier
cve-coordination@incibe.es
KEV Date Added
-