Processmaker

processmaker

Vendor: Processmaker • 5 CVEs

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-38577 1Processmaker 1Processmaker Jul 9, 2026 Sep 19, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.
CVE-2020-13526 1Processmaker 1Processmaker Jun 17, 2026 Dec 10, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. The reportTables_Ajax and clientSetupAjax pages are vulnerable to...Show more SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. The reportTables_Ajax and clientSetupAjax pages are vulnerable to SQL injection in the sort parameter.An attacker can make an authenticated HTTP request to trigger these vulnerabilities.Show less
CVE-2020-13525 1Processmaker 1Processmaker Jun 17, 2026 Dec 3, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An att...Show more The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.Show less
CVE-2016-9045 1Processmaker 1Processmaker Nov 21, 2024 Sep 17, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can...Show more A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability.Show less
CVE-2016-9048 1Processmaker 1Processmaker Nov 21, 2024 Sep 10, 2018 N/A· v4 7.4 HIGH· v3 6.5 MEDIUM· v2 Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters con...Show more Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain setups access the underlying operating system.Show less