PT-2025-40361

CVE-2025-59741

Published

2025-10-02

Updated

2026-10-12

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AndSoft's e-TMS version 25.03

Description An operating system command injection issue exists that allows an attacker to execute operating system commands on the server. This is achieved by sending a POST request to the /CLT/LOGINERRORFRM.ASP endpoint, utilizing the m parameter.

Recommendations Apply a fix or patch to address the vulnerability in the m parameter of the /CLT/LOGINERRORFRM.ASP endpoint.

Exploitability

Fix

Impacts

Researchers

Maximilian Hildebrand

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers