Toptech Systems Tophat
9 CVEs affecting Toptech Systems Tophat. Latest disclosed: 2026-09-29. Critical: 6, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71379 | Critical | 10.0 | 2026-09-29 | The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. |
CVE-2026-70356 | Critical | 9.1 | 2026-09-29 | The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web ser… |
CVE-2026-72510 | Critical | 9.0 | 2026-09-29 | The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection. |
CVE-2026-72507 | Critical | 9.0 | 2026-09-29 | The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulner… |
CVE-2026-68954 | Critical | 9.0 | 2026-09-29 | The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability. |
CVE-2026-63713 | Critical | 9.0 | 2026-09-29 | The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability. |
CVE-2026-71302 | High | 7.1 | 2026-09-29 | The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a s… |
CVE-2026-69662 | Low | 3.7 | 2026-09-29 | The application uses unsafe functions that allow execution of inline scripts and string evaluation functions. |
CVE-2026-71189 | Low | 3.5 | 2026-09-29 | An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user… |