{"schema_version":1,"title":"Toptech Systems vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Toptech Systems: 0 in the last 7 days and 8 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-72510, was published on 29 September 2026. Nothing in the last four weeks, down from 8 vulnerabilities in the four before. 0 critical against 7. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/toptech-systems","json_url":"https://junglewise.ai/threats/vendors/toptech-systems.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/toptech-systems","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":true,"counts":{"high":2,"all_time":9,"critical":7,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":8,"last_365_days":9},"latest":[{"cve":"CVE-2026-72510","cvss":9,"slug":"cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search","title":"Toptech TMS7 and TopHAT SQL injection in business allocation search","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:22.607+00:00","url":"https://junglewise.ai/threats/cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search"},{"cve":"CVE-2026-72507","cvss":9,"slug":"cve-2026-72507-the-reporttype-parameter-in-the-product-summary-report-feature","title":"Toptech TMS7 and TopHAT time-based blind SQL injection in report parameter","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:22.437+00:00","url":"https://junglewise.ai/threats/cve-2026-72507-the-reporttype-parameter-in-the-product-summary-report-feature"},{"cve":"CVE-2026-71379","cvss":10,"slug":"cve-2026-71379-toptech-tms7-and-tophat","title":"The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:21.56+00:00","url":"https://junglewise.ai/threats/cve-2026-71379-toptech-tms7-and-tophat"},{"cve":"CVE-2026-71302","cvss":7.1,"slug":"cve-2026-71302-the-application-accepts-user-supplied-session-identifiers-and","title":"Toptech TMS7 and TopHAT session fixation","severity":"high","exploited":false,"published_at":"2026-09-29T22:18:18.817+00:00","url":"https://junglewise.ai/threats/cve-2026-71302-the-application-accepts-user-supplied-session-identifiers-and"},{"cve":"CVE-2026-70356","cvss":9.1,"slug":"cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file","title":"Toptech TMS7 unrestricted file upload in file endpoint","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:16.14+00:00","url":"https://junglewise.ai/threats/cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file"},{"cve":"CVE-2026-68954","cvss":9,"slug":"cve-2026-68954-the-pattern-parameter-used-in-search-function-in-the-home-page-of","title":"Toptech TMS7 time-based blind SQL injection in search","severity":"critical","exploited":false,"published_at":"2026-09-29T22:17:21.847+00:00","url":"https://junglewise.ai/threats/cve-2026-68954-the-pattern-parameter-used-in-search-function-in-the-home-page-of"},{"cve":"CVE-2026-68068","cvss":9,"slug":"cve-2026-68068-the-screenid-parameter-in-the-electronic-transaction-queue-viewer","title":"Toptech TMS7 and TopHAT SQL injection in transaction queue viewer","severity":"critical","exploited":false,"published_at":"2026-09-29T22:17:15.1+00:00","url":"https://junglewise.ai/threats/cve-2026-68068-the-screenid-parameter-in-the-electronic-transaction-queue-viewer"},{"cve":"CVE-2026-63713","cvss":9,"slug":"cve-2026-63713-the-search-parameter-in-the-view-audit-logs-feature-within-the","title":"Toptech TMS7 and TopHAT time-based SQL injection in audit logs","severity":"critical","exploited":false,"published_at":"2026-09-29T22:17:11.487+00:00","url":"https://junglewise.ai/threats/cve-2026-63713-the-search-parameter-in-the-view-audit-logs-feature-within-the"},{"cve":"CVE-2026-12562","cvss":8.8,"slug":"cve-2026-12562-toptech-systems-rcu-ii-and-multiload-ii-auth-bypass-in-tcf","title":"Toptech Systems RCU II+ and Multiload II+ auth bypass in TCF service","severity":"high","exploited":false,"published_at":"2026-07-30T22:16:53.343+00:00","url":"https://junglewise.ai/threats/cve-2026-12562-toptech-systems-rcu-ii-and-multiload-ii-auth-bypass-in-tcf"}],"vendor":{"hub":true,"name":"Toptech Systems","slug":"toptech-systems","homepage":"https://www.toptech.com/","description":"Toptech Systems is a provider of terminal automation hardware and software for the oil and gas industry.","url":"https://junglewise.ai/threats/vendors/toptech-systems"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":7,"exploited":0,"vulnerabilities":8},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-71379","cvss":10,"slug":"cve-2026-71379-toptech-tms7-and-tophat","title":"The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:21.56+00:00","url":"https://junglewise.ai/threats/cve-2026-71379-toptech-tms7-and-tophat"},{"cve":"CVE-2026-70356","cvss":9.1,"slug":"cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file","title":"Toptech TMS7 unrestricted file upload in file endpoint","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:16.14+00:00","url":"https://junglewise.ai/threats/cve-2026-70356-the-tms-file-upload-endpoint-fails-to-enforce-server-side-file"},{"cve":"CVE-2026-72510","cvss":9,"slug":"cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search","title":"Toptech TMS7 and TopHAT SQL injection in business allocation search","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:22.607+00:00","url":"https://junglewise.ai/threats/cve-2026-72510-the-supplier-no-parameter-used-in-the-business-allocation-search"},{"cve":"CVE-2026-72507","cvss":9,"slug":"cve-2026-72507-the-reporttype-parameter-in-the-product-summary-report-feature","title":"Toptech TMS7 and TopHAT time-based blind SQL injection in report parameter","severity":"critical","exploited":false,"published_at":"2026-09-29T22:18:22.437+00:00","url":"https://junglewise.ai/threats/cve-2026-72507-the-reporttype-parameter-in-the-product-summary-report-feature"},{"cve":"CVE-2026-68954","cvss":9,"slug":"cve-2026-68954-the-pattern-parameter-used-in-search-function-in-the-home-page-of","title":"Toptech TMS7 time-based blind SQL injection in search","severity":"critical","exploited":false,"published_at":"2026-09-29T22:17:21.847+00:00","url":"https://junglewise.ai/threats/cve-2026-68954-the-pattern-parameter-used-in-search-function-in-the-home-page-of"},{"cve":"CVE-2026-68068","cvss":9,"slug":"cve-2026-68068-the-screenid-parameter-in-the-electronic-transaction-queue-viewer","title":"Toptech TMS7 and TopHAT SQL injection in transaction queue viewer","severity":"critical","exploited":false,"published_at":"2026-09-29T22:17:15.1+00:00","url":"https://junglewise.ai/threats/cve-2026-68068-the-screenid-parameter-in-the-electronic-transaction-queue-viewer"},{"cve":"CVE-2026-63713","cvss":9,"slug":"cve-2026-63713-the-search-parameter-in-the-view-audit-logs-feature-within-the","title":"Toptech TMS7 and TopHAT time-based SQL injection in audit logs","severity":"critical","exploited":false,"published_at":"2026-09-29T22:17:11.487+00:00","url":"https://junglewise.ai/threats/cve-2026-63713-the-search-parameter-in-the-view-audit-logs-feature-within-the"},{"cve":"CVE-2026-12562","cvss":8.8,"slug":"cve-2026-12562-toptech-systems-rcu-ii-and-multiload-ii-auth-bypass-in-tcf","title":"Toptech Systems RCU II+ and Multiload II+ auth bypass in TCF service","severity":"high","exploited":false,"published_at":"2026-07-30T22:16:53.343+00:00","url":"https://junglewise.ai/threats/cve-2026-12562-toptech-systems-rcu-ii-and-multiload-ii-auth-bypass-in-tcf"},{"cve":"CVE-2026-71302","cvss":7.1,"slug":"cve-2026-71302-the-application-accepts-user-supplied-session-identifiers-and","title":"Toptech TMS7 and TopHAT session fixation","severity":"high","exploited":false,"published_at":"2026-09-29T22:18:18.817+00:00","url":"https://junglewise.ai/threats/cve-2026-71302-the-application-accepts-user-supplied-session-identifiers-and"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Toptech Systems TMS7","slug":"tms7","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/tms7"},{"name":"Toptech Systems TopHAT","slug":"toptech-systems-tophat","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/toptech-systems-tophat"}]}