Vulnerabilities

TI-2025-20648 CVE-2025-27926 · GHSA-h2w7-2v8j-jgm7

Incorrect default permissions in Nintex Automation

LOW 24

In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00348 Published 2025-03-10 Fixed in 5.8 CWE-276

TI-2025-20647 CVE-2025-27925 · GHSA-vrq6-237q-f4gx

Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.

MEDIUM 43

Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00407 Published 2025-03-10 Fixed in 5.8 CWE-502

TI-2025-20646 CVE-2025-27924 · GHSA-27wx-w49m-rrj8

Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.

LOW 24

Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00218 Published 2025-03-10 Fixed in 5.8 CWE-79

Vulnerabilities

Filters

Incorrect default permissions in Nintex Automation

Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.

Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.