CVE-2026-63713: Toptech TMS7 and TopHAT SQL Injection

Published Sep 29, 2026

Updated

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.

Affected Software

2 affected components

Toptech TMS7

Toptech TopHAT

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Toptech TMS7 to a version that resolves this vulnerability.
Fixed in 7.8

Event History

Sep 29, 2026

CVE Published

via MITRE·09:30 PM

Data Sourced

via MITRE·09:30 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack vector requires high privileges. User interaction is not required, and the attack is network-accessible with low attack complexity.

Which function should be prioritized for review?

Prioritize the View Audit Logs function in the Utilities section, specifically requests that supply the "search" parameter. The reported issue is a time-based blind SQL injection in that parameter.