CVE-2025-40668

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty.

• CWE-863

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1Third Party Advisory

Published

Jun 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40662Absolute path disclosure vulnerability in DM Corporative CMS…7.5
• CVE-2025-40663Stored Cross-Site Scripting (XSS) vulnerability in i2A-Crono…5.1
• CVE-2025-40664Missing authentication vulnerability in TCMAN GIM v11. This …9.1
• CVE-2025-40665Time-based blind SQL injection vulnerabilities in TCMAN's GI…9.8
• CVE-2025-40666Time-based blind SQL injection vulnerabilities in TCMAN's GI…9.8
• CVE-2025-40667Missing authorization vulnerability in TCMAN's GIM v11. This…6.5
• CVE-2025-40669Incorrect authorization vulnerability in TCMAN's GIM v11. Th…6.5
• CVE-2025-4067A vulnerability classified as critical has been found in Scr…6.9
• CVE-2025-40670Incorrect authorization vulnerability in TCMAN's GIM v11. Th…8.8
• CVE-2025-40671SQL injection vulnerability in AES Multimedia's Gestnet v1.0…9.3
• CVE-2025-40672A Privilege Escalation vulnerability has been found in Panlo…8.5
• CVE-2025-40673A Missing Authorization vulnerability has been found in Dino…5.3