# CVE-2026-72510: Toptech TMS7 and TopHAT SQL injection in business allocation search

Source: https://junglewise.ai/threats/cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-72510 · Severity: critical · CVSS 9 · Published 2026-09-29

Toptech TMS7 and TopHAT are systems used to manage transportation and logistics operations. The business allocation search feature accepts a supplier number parameter without proper input validation, allowing attackers with administrative privileges to extract sensitive data from the database through time-based blind SQL injection attacks.

Technologies: [Toptech Systems TMS7](https://junglewise.ai/threats/technologies/tms7), [Toptech Systems TopHAT](https://junglewise.ai/threats/technologies/toptech-systems-tophat). Vendors: [Toptech Systems](https://junglewise.ai/threats/vendors/toptech-systems).

## Quick answers

**Is CVE-2026-72510 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72510 being exploited in the wild.

**How severe is CVE-2026-72510?** Critical severity, with a CVSS score of 9, published 29 September 2026.

**Which products and versions are affected?** Toptech Systems TMS7 7.6.3; Toptech Systems TopHAT 7.6.3.

**Is there a fix for CVE-2026-72510?** A patch was published on 2026-09-29: Fixed in version 7.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72510 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-72510?** Check whether you run Toptech Systems TMS7 or Toptech Systems TopHAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The "supplier_no" parameter in the business allocation search endpoint is vulnerable to time-based blind SQL injection (CWE-89). An authenticated attacker with high privileges can craft malicious SQL queries to exfiltrate data from the backend database by observing response timing delays. The vulnerability requires authentication and high-privilege access, limiting exposure but allowing privileged insiders or attackers who have compromised administrative accounts to access critical data.

## Affected products

- Toptech Systems TMS7 7.6.3
- Toptech Systems TopHAT 7.6.3

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: Fixed in version 7.8

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02)

## Related threats

- [Toptech TMS7 and TopHAT time-based blind SQL injection in report parameter](https://junglewise.ai/threats/cve-2026-72507-the-reporttype-parameter-in-the-product-summary-report-feature)
- [The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.](https://junglewise.ai/threats/cve-2026-71379-toptech-tms7-and-tophat)
- [Toptech TMS7 and TopHAT session fixation](https://junglewise.ai/threats/cve-2026-71302-the-application-accepts-user-supplied-session-identifiers-and)
- [Toptech TMS7 unrestricted file upload in file endpoint](https://junglewise.ai/threats/cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file)
- [Toptech TMS7 time-based blind SQL injection in search](https://junglewise.ai/threats/cve-2026-68954-the-pattern-parameter-used-in-search-function-in-the-home-page-of)