CVE-2025-67281

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - cve@mitre.org

Published

2026-01-09

Last modified

2026-01-09

Weaknesses

CWE-89

Affected products

• Tim Flow (Tim-solutions)

References

• https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes
• https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities/