Which versions of Chanjet TPlus are affected by CVE-2025-14190?

Chanjet TPlus contains a critical SQL injection vulnerability affecting versions up to 20251121 that allows unauthenticated remote attackers to compromise database integrity and access sensitive…

How to fix or mitigate CVE-2025-14190?

Within 24 hours: Identify all Chanjet TPlus instances in your environment and isolate them from untrusted networks; enable detailed logging on affected systems and review recent access logs for exploitation attempts. Within 7 days: Implement WAF rules to block requests to the vulnerable endpoint (/tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController); conduct preliminary forensic analysis of database logs for unauthorized access or modifications. Within 30 days: Evaluate upgrade options or replacement solutions; engage Chanjet for patch availability; if no patch emerges, develop a remediation timeline including application replacement or decommissioning.

Chanjet TPlus CVE-2025-14190

Q: What is the CVSS score of CVE-2025-14190?

CVE-2025-14190 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-201599 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-07 cna@vuldb.com

SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 17:50 euvd

EUVD-2025-201599

Analysis Generated

Mar 15, 2026 - 17:50 vuln.today

CVE Published

Dec 07, 2025 - 13:15 nvd

HIGH 7.3

DescriptionCVE.org

A flaw has been found in Chanjet TPlus up to 20251121. Affected by this vulnerability is an unknown functionality of the file /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanySettingController,Ufida.T.SM.UIP.ashx?method=Load. This manipulation of the argument currentAccId causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Chanjet TPlus through version 20251121 allows remote unauthenticated attackers to manipulate the currentAccId parameter in the MultiCompanySettingController ASHX handler, leading to limited data tampering, information disclosure, and service disruption. Public exploit code is available; however, no active exploitation has been confirmed (not listed in CISA KEV), and EPSS indicates low probability of widespread attacks.