CVE-2025-14190

Name of the Vulnerable Software and Affected Versions Chanjet TPlus versions prior to 20251121

Description A flaw exists in Chanjet TPlus that allows for SQL injection. The issue is related to the manipulation of the currentAccId argument within the file '/tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController,Ufida.T.SM.UIP.ashx?method=Load'. This manipulation occurs through the /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController API endpoint. The attack can be initiated remotely. The exploit has been published.

Recommendations Update Chanjet TPlus to a version later than 20251121.