AndSoft e-TMS vulnerabilities

An operating system command injection vulnerability exists in AndSoft's e-TMS v25.03.03. An attacker can execute arbitrary OS commands on the server by sending a crafted POST request with the 'm' parameter to '/CLT/LOGINERRORFRM.ASP'.

AndSoft e-TMS v25.03 contains a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by sending a malicious URL with parameters 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in the path '/clt/LOGINFRM_VON.ASP'.

Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_TP.ASP'.

Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_SIL.ASP'.