Toptech Systems
Monthly
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a chosen session identifier into a victim's browser/client and then reuse that same identifier after the victim logs in, effectively hijacking the authenticated session and gaining the victim's privileges on the fuel-terminal management application. The reported severity is CVSS 7.5 (CVSS v4.0), and the independent assessment rates confidentiality and integrity impact as high with high attack complexity, because success requires both successful session-ID seeding and the victim subsequently authenticating with that identifier. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV) at time of analysis, though ICS-CERT has published an advisory (ICSA-26-272-02) indicating OT/ICS relevance.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject SQL through the 'reportType' parameter of the product summary report in the balancing reports section, with data recovered indirectly by measuring database response delays rather than returned in the response. The issue is remotely reachable with no user interaction but is gated behind a privileged session (vendor CVSS:4.0 base 8.5; independent assessment CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L), so confidentiality is the primary exposure while integrity and availability impacts remain limited. Exploitation status: no public exploit identified at time of analysis, and the vendor addresses it by upgrading to TMS7 v7.8; taken together this is a genuine but access-gated data-confidentiality issue in a niche OT deployment rather than an internet-wide emergency.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated high-privilege user inject SQL through the 'screenID' parameter of the electronic transaction queue viewer in the manual transactions section, using response-time delays to infer database contents. Exploitation requires an existing high-privilege (PR:H) session on the affected web interface, so anonymous and low-privilege users are excluded, and the blind, inference-based technique makes data extraction slow rather than directly returned. No public exploit code has been identified at time of analysis and the issue is remediated in TMS7 version 7.8, so despite the vendor's CVSS 4.0 score of 8.5 the practical operational priority for most terminal operators is moderate.
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application lets an attacker who already holds a high-privileged session inject SQL through the 'pattern' query parameter and infer database contents from response timing. The vendor addressed the flaw in TMS7 version 7.8, so unpatched pre-7.8 deployments are the exposed population; TOPHAT is also listed in the affected CPE set. The issue requires authenticated high-privileged access (CVSS PR:H) and the product has a limited OT footprint, so this is a real but access-gated concern rather than an internet-scale emergency, and no public exploit identified at time of analysis.
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech Systems' TMS7 and TopHat terminal-automation platforms, confirmed affecting version 7.6.3, lets an attacker with an authenticated high-privilege session force the backend database to leak data through conditional response delays. Exploitation is access-gated rather than open: the independent assessment (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) aligns with the vendor's v4.0 vector (PR:H) in requiring a privileged, authenticated foothold, and the flaws sit in OT/terminal-management deployments that are normally segmented rather than internet-facing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped a fix in TMS7 v7.8.
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and earlier lets a high-privilege authenticated attacker inject SQL through the supplier_no parameter and infer database contents by measuring conditional query delays. The vendor fixed the issue in TMS7 v7.8, documented in CISA ICS advisory ICSA-26-272-02 and tracked as EUVD-2026-89428, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because exploitation requires a privileged authenticated session against the business allocation search endpoint, the issue is access-gated rather than broadly reachable, although the assessed confidentiality and availability impacts on the database are high.
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS file upload endpoint performs no server-side file type validation, letting a PHP payload be written to the web server and then executed. The flaw is network-reachable and requires no user interaction, but the CVSS vector (PR:H) and the independent assessment confirm it is only exploitable by a remote attacker who already holds high-privilege authenticated access to the TMS7/TopHat web application - a default configuration without valid credentials is not vulnerable. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the terminal management system; no public exploit code and no CISA KEV entry were identified at time of analysis, and the deployment base is a niche petroleum/OT terminal management environment.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker submit a single crafted POST request and pull arbitrary database tables out of the system - an information disclosure of the highest severity as scored by CISA ICS (CVSS 10.0), and assessed by our analysis as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. confidentiality-only impact with no integrity or availability effect. Affected are deployments of Toptech TMS7 (all versions captured in CPE with a wildcard version) and TopHat, which are OT/ICS fuel-terminal and terminal-automation products typically expected to sit on segmented operational networks; the decisive factor for real-world exploitability is whether the export endpoint is reachable from outside that trusted OT segment, since no authentication, user interaction, or non-default toggle is required. There is no public exploit code identified at time of analysis and the flaw is not listed on CISA KEV, so exposure should be treated as a configuration-and-segmentation problem rather than a confirmed ongoing campaign. Authentication requirements are not in question here: the CVSS vector contains PR:N, so exploitation is unauthenticated.
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) allows an authenticated attacker to inject JavaScript that executes in a second application user's browser within that user's active session. Exploitation is not remotely triggerable against a default installation: it requires the attacker to hold valid application credentials (PR:L per the assessed vector) and to socially engineer a logged-in user into issuing the attacker-constructed request (UI:A), with impact confined to the victim's session and limited to low confidentiality effect. Toptech has addressed the issue in TMS7 version 7.8; instances below that release remain exposed, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a genuinely low-priority, social-engineering-dependent XSS.
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-class) functions in Toptech TMS7 and Toptech TopHat terminal-management deployments, achieving limited code injection with Low confidentiality and integrity impact and no availability effect. The issue is scored 2.1 under CVSS 4.0 and was independently assessed as AV:A/AC:H/PR:L/UI:N with Low C/I, so it sits firmly in the low-priority tier despite its CWE-95 code-injection classification: it is not reachable from the internet by default, requires valid low-privilege credentials, and demands high attack complexity to land the crafted input on the evaluator. No public exploit code has been identified at time of analysis, the issue does not appear on CISA KEV, and no EPSS score was supplied in the source data, so exploitation is not confirmed to be active.
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a chosen session identifier into a victim's browser/client and then reuse that same identifier after the victim logs in, effectively hijacking the authenticated session and gaining the victim's privileges on the fuel-terminal management application. The reported severity is CVSS 7.5 (CVSS v4.0), and the independent assessment rates confidentiality and integrity impact as high with high attack complexity, because success requires both successful session-ID seeding and the victim subsequently authenticating with that identifier. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV) at time of analysis, though ICS-CERT has published an advisory (ICSA-26-272-02) indicating OT/ICS relevance.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject SQL through the 'reportType' parameter of the product summary report in the balancing reports section, with data recovered indirectly by measuring database response delays rather than returned in the response. The issue is remotely reachable with no user interaction but is gated behind a privileged session (vendor CVSS:4.0 base 8.5; independent assessment CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L), so confidentiality is the primary exposure while integrity and availability impacts remain limited. Exploitation status: no public exploit identified at time of analysis, and the vendor addresses it by upgrading to TMS7 v7.8; taken together this is a genuine but access-gated data-confidentiality issue in a niche OT deployment rather than an internet-wide emergency.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated high-privilege user inject SQL through the 'screenID' parameter of the electronic transaction queue viewer in the manual transactions section, using response-time delays to infer database contents. Exploitation requires an existing high-privilege (PR:H) session on the affected web interface, so anonymous and low-privilege users are excluded, and the blind, inference-based technique makes data extraction slow rather than directly returned. No public exploit code has been identified at time of analysis and the issue is remediated in TMS7 version 7.8, so despite the vendor's CVSS 4.0 score of 8.5 the practical operational priority for most terminal operators is moderate.
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application lets an attacker who already holds a high-privileged session inject SQL through the 'pattern' query parameter and infer database contents from response timing. The vendor addressed the flaw in TMS7 version 7.8, so unpatched pre-7.8 deployments are the exposed population; TOPHAT is also listed in the affected CPE set. The issue requires authenticated high-privileged access (CVSS PR:H) and the product has a limited OT footprint, so this is a real but access-gated concern rather than an internet-scale emergency, and no public exploit identified at time of analysis.
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech Systems' TMS7 and TopHat terminal-automation platforms, confirmed affecting version 7.6.3, lets an attacker with an authenticated high-privilege session force the backend database to leak data through conditional response delays. Exploitation is access-gated rather than open: the independent assessment (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) aligns with the vendor's v4.0 vector (PR:H) in requiring a privileged, authenticated foothold, and the flaws sit in OT/terminal-management deployments that are normally segmented rather than internet-facing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped a fix in TMS7 v7.8.
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and earlier lets a high-privilege authenticated attacker inject SQL through the supplier_no parameter and infer database contents by measuring conditional query delays. The vendor fixed the issue in TMS7 v7.8, documented in CISA ICS advisory ICSA-26-272-02 and tracked as EUVD-2026-89428, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because exploitation requires a privileged authenticated session against the business allocation search endpoint, the issue is access-gated rather than broadly reachable, although the assessed confidentiality and availability impacts on the database are high.
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS file upload endpoint performs no server-side file type validation, letting a PHP payload be written to the web server and then executed. The flaw is network-reachable and requires no user interaction, but the CVSS vector (PR:H) and the independent assessment confirm it is only exploitable by a remote attacker who already holds high-privilege authenticated access to the TMS7/TopHat web application - a default configuration without valid credentials is not vulnerable. Successful exploitation yields full compromise of confidentiality, integrity, and availability of the terminal management system; no public exploit code and no CISA KEV entry were identified at time of analysis, and the deployment base is a niche petroleum/OT terminal management environment.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker submit a single crafted POST request and pull arbitrary database tables out of the system - an information disclosure of the highest severity as scored by CISA ICS (CVSS 10.0), and assessed by our analysis as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. confidentiality-only impact with no integrity or availability effect. Affected are deployments of Toptech TMS7 (all versions captured in CPE with a wildcard version) and TopHat, which are OT/ICS fuel-terminal and terminal-automation products typically expected to sit on segmented operational networks; the decisive factor for real-world exploitability is whether the export endpoint is reachable from outside that trusted OT segment, since no authentication, user interaction, or non-default toggle is required. There is no public exploit code identified at time of analysis and the flaw is not listed on CISA KEV, so exposure should be treated as a configuration-and-segmentation problem rather than a confirmed ongoing campaign. Authentication requirements are not in question here: the CVSS vector contains PR:N, so exploitation is unauthenticated.
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) allows an authenticated attacker to inject JavaScript that executes in a second application user's browser within that user's active session. Exploitation is not remotely triggerable against a default installation: it requires the attacker to hold valid application credentials (PR:L per the assessed vector) and to socially engineer a logged-in user into issuing the attacker-constructed request (UI:A), with impact confined to the victim's session and limited to low confidentiality effect. Toptech has addressed the issue in TMS7 version 7.8; instances below that release remain exposed, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a genuinely low-priority, social-engineering-dependent XSS.
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-class) functions in Toptech TMS7 and Toptech TopHat terminal-management deployments, achieving limited code injection with Low confidentiality and integrity impact and no availability effect. The issue is scored 2.1 under CVSS 4.0 and was independently assessed as AV:A/AC:H/PR:L/UI:N with Low C/I, so it sits firmly in the low-priority tier despite its CWE-95 code-injection classification: it is not reachable from the internet by default, requires valid low-privilege credentials, and demands high attack complexity to land the crafted input on the evaluator. No public exploit code has been identified at time of analysis, the issue does not appear on CISA KEV, and no EPSS score was supplied in the source data, so exploitation is not confirmed to be active.