Processmaker - vulnerabilities (CVEs)
10 CVEs in 2 products, 1 in the last 30 days, newest from 2026-10-09.
Products
- Processmaker - 9 CVEs
- Processmaker Enterprise - 2 CVEs
Newest CVEs of Processmaker
- CVE-2026-107803 - CVSS 6.5 (medium), 2026-10-09: ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL…
- CVE-2021-47978 - CVSS 6.9 (medium), 2026-05-16: ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path…
- CVE-2013-10035 - CVSS 8.7 (high), 2025-07-31: A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute…
- CVE-2025-34097 - CVSS 8.6 (high), 2025-07-10: An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker…
- CVE-2024-25506 - CVSS 6.5 (medium), 2024-03-28: Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pm_sys_sys…
- CVE-2022-38577 - CVSS 8.8 (high), 2022-09-19: ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal…
- CVE-2020-13526 - CVSS 8.8 (high), 2020-12-10: SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. The…
- CVE-2020-13525 - CVSS 8.8 (high), 2020-12-03: The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11. A…
- CVE-2016-9045 - CVSS 8.8 (high), 2018-09-17: A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization…
- CVE-2016-9048 - CVSS 7.4 (high), 2018-09-10: Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL…
