CVE-2025-41013

Critical · 9.8

CVSS

9.8

EPSS

0.3%

Published

Dec 2, 2025

CISA due date

—

The record

SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.

Affected packages

Ecosystem	Package	Introduced	Fixed