Vendors / ProcessMaker Records 9 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 7
Exploited now ProcessMaker records in CISA KEV No ProcessMaker vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 44
ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02167 · Published 2022-09-19 · No fix listed CWE-281
Priority MEDIUM 42
A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02211 · Published 2018-09-17 · No fix listed CWE-502
Priority MEDIUM 41
SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01703 · Published 2020-12-10 · No fix listed CWE-89
Priority MEDIUM 41
The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01703 · Published 2020-12-03 · No fix listed CWE-89
Priority LOW 34
Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community.
CVSS 3.1 HIGH 7.4· Network · Low privileges · No interaction · EPSS 0.00798 · Published 2018-09-10 · No fix listed CWE-89
Open these records in search → All records by CVSS severity
0 7 2 0 0
THREATIST.IORead the docs