Vendors / ProcessMaker Records 9 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 7
Exploited now ProcessMaker records in CISA KEV No ProcessMaker vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 73
A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin.
CVSS 4.0 HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.0249 · Published 2025-07-31 · Fixed in 2.5.2 CWE-94
Priority HIGH 72
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives.
CVSS 4.0 HIGH 8.6· Network · High privileges · No interaction · EPSS 0.01722 · Published 2025-07-10 · Fixed in 3.5.4 CWE-434
Priority MEDIUM 64
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation.
CVSS 4.0 MEDIUM 6.9· Local · No auth · No interaction · EPSS 0.00776 · Published 2026-05-16 · No fix listed CWE-98
Priority MEDIUM 44
ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02167 · Published 2022-09-19 · No fix listed CWE-281
Priority MEDIUM 42
A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02211 · Published 2018-09-17 · No fix listed CWE-502
Priority MEDIUM 41
SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01703 · Published 2020-12-10 · No fix listed CWE-89
Priority MEDIUM 41
The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01703 · Published 2020-12-03 · No fix listed CWE-89
Priority LOW 34
Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community.
CVSS 3.1 HIGH 7.4· Network · Low privileges · No interaction · EPSS 0.00798 · Published 2018-09-10 · No fix listed CWE-89
Priority LOW 28
ProcessMaker is an open source workflow management software suite.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00249 · Published 2026-10-09 · Fixed in 2026.14.3 CWE-89
Open these records in search → All records by CVSS severity
0 7 2 0 0
THREATIST.IORead the docs