Threats affecting pkg:github/cisagov/TMS7

5 threats

Severity	CVSS	Signals	Threat	Source	Published
Low	3.7	EPSS 0.2%	CVE-2026-69662Toptech Systems TMS7 · Eval Injection Low3.7EPSS 0.2%2026-09-29CVE Database V5CVE-2026-69662 The application uses unsafe functions that allow execution of inline scripts and string evaluation functions. EPSS 0.2%Vulnerability CWE-95 #ghsa-hxwh-85p6-wm8w	CVE Database V5	2026-09-29
High	7.1	EPSS 0.3%	CVE-2026-71302Toptech Systems TMS7 · CWE-384 High7.1EPSS 0.3%2026-09-29CVE Database V5CVE-2026-71302 The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover. EPSS 0.3%Vulnerability CWE-384 #ghsa-vq4x-j66h-qfjc	CVE Database V5	2026-09-29
Critical	9.0	EPSS 0.3%	CVE-2026-68954Toptech Systems TMS7 · SQL Injection Critical9.0EPSS 0.3%2026-09-29CVE Database V5CVE-2026-68954 The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability. EPSS 0.3%Vulnerability CWE-89 #ghsa-6c5h-cm4j-w42x	CVE Database V5	2026-09-29
Critical	9.1	EPSS 0.4%	CVE-2026-70356Toptech Systems TMS7 · Unrestricted File Upload Critical9.1EPSS 0.4%2026-09-29CVE Database V5CVE-2026-70356 The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server. EPSS 0.4%Vulnerability CWE-434 #ghsa-63hp-3v6g-vpmq	CVE Database V5	2026-09-29
Critical	10.0	EPSS 0.5%	CVE-2026-71379Toptech Systems TMS7 · Exposed Files or Directories Critical10.0EPSS 0.5%2026-09-29CVE Database V5CVE-2026-71379 The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. EPSS 0.5%Vulnerability CWE-552 #ghsa-qxj4-w6f9-5q44	CVE Database V5	2026-09-29

Page 1 of 1