CVE-2025-41013 is a critical SQL injection (CVSS 9.8) in TCMAN GIM v11, a maintenance management product. A crafted request to one page can read or change the database. INCIBE reports the vendor fixed it in version 20250401, so upgrade from build 20250304.
What's affected
The CVE record names TCMAN GIM v11 in version 20250304. The weak spot is the idmant parameter of the page /PC/frmEPIS.aspx, reached with a GET request.
INCIBE, the Spanish CERT that coordinated the disclosure, states the vulnerabilities were fixed by TCMAN in version 20250401. It also lists three sibling issues in the same product: CVE-2025-41012, CVE-2025-41014 and CVE-2025-41015. Those cover an authorization problem and two user enumeration cases in a web service.
One detail worth knowing: NVD scores this at 9.8 with no privileges required, while INCIBE gives a CVSS v4.0 vector that lists low privileges. Plan as if an unauthenticated attacker could reach it until you have tested your own deployment.
How to check if you're exposed
Find the build of GIM installed on each server. The version string is shown in the application, and your installer or deployment notes should record it. Build 20250304 is the one named in the record. Anything older than 20250401 should be treated as unpatched unless TCMAN tells you otherwise.
Then check exposure. Is the GIM web front end reachable from the internet, or only from the internal network? Review web server logs for requests to /PC/frmEPIS.aspx and look for unusual values in the idmant parameter, or for a sudden rise in server errors from that page.
If you cannot tell which builds are deployed, ask TCMAN or your integrator for the exact version and the 20250401 release notes.
What to do now
- Confirm the installed GIM build on every environment, including test and training servers.
- Upgrade to version 20250401 or later, following TCMAN instructions.
- Restrict access to the web front end to the networks that need it, and put it behind a VPN if remote access is required.
- Use a database account with the least privileges the application needs, so a query flaw cannot drop or rewrite everything.
- Review logs for the affected page back to when 20250304 was deployed, and keep a database backup you have tested.
Why it matters
This is CWE-89, SQL injection. The page builds a database query using text taken from the request. If that text is not handled as plain data, an attacker can change what the query does. The record says the result is the ability to retrieve, create, update and delete databases, which is the full loss of confidentiality, integrity and availability.
The fix pattern is old and well known: parameterized queries, input validation and a database user with narrow rights. This CVE is not on the CISA Known Exploited Vulnerabilities list. A maintenance system often holds asset records and staff details, which is reason enough to patch quickly.
Try it yourself
Web flaws like this one are found by testing the running app. This demo walks through a dynamic scan of a web application.
Click through it at your own pace, or open it full screen.
Quick check
Which TCMAN GIM version fixes CVE-2025-41013?
INCIBE says the vulnerabilities were fixed in version 20250401. The vulnerable build named in the record is 20250304. Confirm with TCMAN for your own release line.
Does this need a login to exploit?
The NVD vector says no privileges are needed. INCIBE lists low privileges. Treat it as reachable without a login until you have tested.
Sources
Last reviewed: 18 October 2026.
