SQL injection in ProcessMaker Enterprise
Priority LOW 34CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain setups access the underlying operating system.
Why it matters now
EPSS 0.00798 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ProcessMaker | ProcessMaker Enterprise | ProcessMaker Enterprise Core 3.0.1.7-community | — | No fix listed | CNA |
- ProcessMaker Enterprise VendorProcessMaker Affected ProcessMaker Enterprise Core 3.0.1.7-community Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:processmaker:processmaker:3.0.1.7:*:*:*:community:*:*:* | 3.0.1.7 | Vulnerable | ProcessMaker |
| cpe:2.3:a:processmaker:processmaker:3.0.1.7:*:*:*:enterprise:*:*:* | 3.0.1.7 | Vulnerable | ProcessMaker |
- cpe:2.3:a:processmaker:processmaker:3.0.1.7:*:*:*:community:*:*:* Versions 3.0.1.7 Vulnerable ·ProcessMaker
- cpe:2.3:a:processmaker:processmaker:3.0.1.7:*:*:*:enterprise:*:*:* Versions 3.0.1.7 Vulnerable ·ProcessMaker
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-9048
- 2026-10-03 Alias added: GHSA-72fq-mcfp-rpj7
References
More Processmaker vulnerabilities
- TI-2022-18153 ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user… CVSS 3.1HIGH 8.8
- TI-2016-07407 Deserialization of untrusted data in ProcessMaker Enterprise CVSS 3.1HIGH 8.8
- TI-2020-10605 SQL injection in ProcessMaker CVSS 3.1HIGH 8.8
- TI-2020-10604 SQL injection in ProcessMaker CVSS 3.1HIGH 8.8
Sources
- CVE-2016-9048 · CVE Program
- CVE-2016-9048 · NVD
- FIRST EPSS
- GHSA-72fq-mcfp-rpj7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences