Vulnerabilities

TI-2026-70027 CVE-2026-107803

SQL injection in ProcessMaker tasks endpoint via order_by parameter

LOW 28

ProcessMaker is an open source workflow management software suite.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00249 Published 2026-10-09 Fixed in 2026.14.3 CWE-89

TI-2021-22591 CVE-2021-47978 · GHSA-c522-p4cv-rfpf

ProcessMaker 3.5.4 Local File Inclusion via Path Traversal

MEDIUM 64

ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00776 Published 2026-05-16 No fix listed CWE-98

TI-2013-06178 CVE-2013-10035 · GHSA-q65g-898q-8jpw

ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution

HIGH 73

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0249 Published 2025-07-31 Fixed in 2.5.2 CWE-94

TI-2025-24257 CVE-2025-34097 · GHSA-vqrr-v7vg-qrp6

ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE

HIGH 72

An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01722 Published 2025-07-10 Fixed in 3.5.4 CWE-434

TI-2022-18153 CVE-2022-38577 · GHSA-gc28-55g9-f45f

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user…

MEDIUM 44

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02167 Published 2022-09-19 No fix listed CWE-281

TI-2020-10605 CVE-2020-13526 · GHSA-fmx8-rqgc-5vmx

SQL injection in ProcessMaker

MEDIUM 41

SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01703 Published 2020-12-10 No fix listed CWE-89

TI-2020-10604 CVE-2020-13525 · GHSA-cj9c-5245-m5rj

SQL injection in ProcessMaker

MEDIUM 41

The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01703 Published 2020-12-03 No fix listed CWE-89

TI-2016-07407 CVE-2016-9045 · GHSA-pmvr-f574-5c53

Deserialization of untrusted data in ProcessMaker Enterprise

MEDIUM 42

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02211 Published 2018-09-17 No fix listed CWE-502

TI-2016-07408 CVE-2016-9048 · GHSA-72fq-mcfp-rpj7

SQL injection in ProcessMaker Enterprise

LOW 34

Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00798 Published 2018-09-10 No fix listed CWE-89

Vulnerabilities

Filters