SQL Injection Vulnerability in Electronic Transaction Queue Viewer by TopTech
CVE-2026-68068

8.5HIGH

Key Information:

Vendor

Toptech Systems

Status
Tms7
Tophat
Vendor
CVE Published:
29 September 2026

What is CVE-2026-68068?

The electronic transaction queue viewer component of TopTech's system is vulnerable due to inadequate input validation on the 'screenID' parameter. This flaw allows potential attackers to exploit the system via time-based blind SQL injection techniques, which can lead to unauthorized access to sensitive database information. Implementing proper security measures is critical to mitigating this risk.

Affected Version(s)

TMS7 7.6.3

TopHAT 7.6.3

TMS7 7.8

References

https://www.toptech.com/blog/tms7-version-7-8-strengthens...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sachin Shetty and Roy Duisters of Shell CyberDefence reported this vulnerability to Toptech and CISA.
.