TI-2025-20647 CVE-2025-27925 · GHSA-vrq6-237q-f4gx
Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
Priority MEDIUM 43
Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
Nintex
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Nintex records in CISA KEVNo Nintex vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2015-06071 CVE-2015-7299 · GHSA-3vm4-857h-6jjc
SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl…
Priority LOW 37
SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter.
TI-2022-17865 CVE-2022-38167 · GHSA-frv7-33r5-fg4g
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
Priority LOW 27
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
TI-2025-20648 CVE-2025-27926 · GHSA-h2w7-2v8j-jgm7
Incorrect default permissions in Nintex Automation
Priority LOW 24
In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.
TI-2025-20646 CVE-2025-27924 · GHSA-27wx-w49m-rrj8
Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.
Priority LOW 24
Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.