Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Chanjet TPlus: Remote SQL Injection Risk through Malicious Input

CVE-2025-14190 · published 11 months ago
Summary

A security flaw in Chanjet TPlus allows an attacker to potentially inject malicious code into the system, which could lead to unauthorized data access or system compromise. This vulnerability can be exploited remotely, and a working exploit is publicly available. Chanjet has not responded to the vulnerability disclosure, so users should consider this a high-priority issue.

Original advisory text
A flaw has been found in Chanjet TPlus up to 20251121. Affected by this vulnerability is an unknown functionality of the file /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController,Ufida.T.SM....
A flaw has been found in Chanjet TPlus up to 20251121. Affected by this vulnerability is an unknown functionality of the file /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController,Ufida.T.SM.UIP.ashx?method=Load. This manipulation of the argument currentAccId causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published7 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-14190 · NVD
Track software like this
Free during beta