120 matches found
CVE-2026-107803
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...
CVE-2026-107803
The open-source workflow management software ProcessMaker is vulnerable to SQL injection in the GET /api/1.0/tasks endpoint prior to version 2026.14.3 . The root cause is located in ProcessMaker raits askcontrollerindexmethods::applycolumnordering(), where the application concatenates a user-cont...
CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...
EUVD-2026-95777
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...
PT-2026-108909
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the order by parameter because ProcessMakerTraitsTaskControllerIndexMethods::applyColumnOrdering concatenates a...
CVE-2022-38577-Processmaker
تم أرشفة هذا المستودع ونقله إلى: https://github.com/sornram9254/CVE-BBP-VDP ProcessMaker - تصعيد صلاحيات ملف تعريف المستخدم CVE-2022-38577 تم اكتشاف أن ProcessMaker قبل الإصدار v3.5.4 يحتوي على أذونات غير آمنة في صفحة ملف تعريف المستخدم. تسمح هذه الثغرة للمهاجمين بتصعيد المستخدمين العاديين إلى...
CVE-2024-41453_CVE-2024-41454
CVE-2024-41453 CVE-2024-41454 ثغرات ProcessMaker للتعليم فقط: @ryancooley @velkymx @nolanpro @caleeli قم بتثبيت نسخة ProcessMaker 4 Core Docker من هذا المستودع: https://github.com/ProcessMaker/pm4core-docker هذا هو أحدث إصدار من pm docker PMVERSION=4.1.21، الصورة أدناه هي ملف .env. ثغرة XSS المخز...
CVE-2021-47978
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without...
CVE-2021-47978 ProcessMaker 3.5.4 Local File Inclusion via Path Traversal
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without...
CVE-2021-47978
CVE-2021-47978 : ProcessMaker 3.5.4 contains a Local File Inclusion (LFI) flaw caused by improper path traversal validation. Unauthenticated attackers can access arbitrary files by sending directory traversal sequences, potentially reading sensitive files such as /etc/passwd. The vulnerability is...
EUVD-2021-34839
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without...
CVE-2021-47978
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without...
CVE-2021-47978 ProcessMaker 3.5.4 Local File Inclusion via Path Traversal
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without...
CVE-2021-47978: Improper Control of Filename for Include/Require Statement in PHP Program
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without...
PT-2026-41464
Name of the Vulnerable Software and Affected Versions ProcessMaker version 3.5.4 Description Improper path traversal validation allows unauthenticated attackers to read arbitrary files. By sending requests containing directory traversal sequences, an attacker can access sensitive system files, su...
ProcessMaker 安全漏洞
ProcessMaker is a web-based system developed by ProcessMaker Inc. in the PHP language, used for business process management BPM and workflow management. Version 3.5.4 of ProcessMaker contains a security vulnerability. This vulnerability stems from a local file inclusion flaw, which allows...
EUVD-2013-7254
Malware in sbrugna...
EUVD-2016-9869
Malware in sbrugna...