CVE-2025-59754
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Reflected XSS vulnerability in AndSoft's e-TMS v25.03. It allows an attacker to execute JavaScript in the victim's browser via a malicious URL. Parameters 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_original.ASP' are affected.
Risk Assessment
An attacker could steal authentication data or hijack a user session, potentially leading to unauthorized system access.
Recommendation
Update e-TMS and apply input filtering for all mentioned parameters.
Other vulnerabilities in AndSoft e-TMS
See all- CVE-2025-59743Critical
AndSoft e-TMS v25.03 is vulnerable to SQL injection in /inc/connect/CONNECTION.ASP via the 'SessionID' cookie. An attacker can send a POST request to retrieve, create, update, and delete database data.
- CVE-2025-59742Critical
SQL injection vulnerability in AndSoft's e-TMS v25.03. It exists in the 'USRMAIL' parameter in '/inc/login/TRACK_REQUESTFRMSQL.ASP' and allows an attacker to retrieve, create, update, and delete databases by sending a POST request.
- CVE-2025-59741Critical
An operating system command injection vulnerability exists in AndSoft's e-TMS v25.03.03. An attacker can execute arbitrary OS commands on the server by sending a crafted POST request with the 'm' parameter to '/CLT/LOGINERRORFRM.ASP'.
- CVE-2025-59740Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_CAT.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59739Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_original.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59738Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_BET.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59737Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_LXA.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59736Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_DJO.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59735Critical
AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM.ASP. An attacker can send a POST request to execute arbitrary commands on the server.
- CVE-2025-59774Medium
AndSoft e-TMS v25.03 contains a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by sending a malicious URL with parameters 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in the path '/clt/LOGINFRM_VON.ASP'.
Original NVD description (English source)
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_original.ASP'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS