CVE-2024-25506

Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pmsyssys cookie...

PT-2024-20968 · Unknown · Processmaker

Name of the Vulnerable Software and Affected Versions: ProcessMaker versions prior to 4.0 Description: The issue allows a remote attacker to run arbitrary code via control of the pm sys sys cookie. This can lead to a Cross Site Scripting attack. Recommendations: For versions prior to 4.0, update ...

CVE-2024-25506: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pmsyssys cookie...

ProcessMaker 安全漏洞

ProcessMaker is a Php-written site builder for business process management BPM and workflow management from ProcessMaker, Inc. in the United States. A security vulnerability exists in ProcessMaker versions prior to 4.0 that stems from the presence of a cross-site scripting vulnerability that coul...

BIT-PROCESSMAKER-2020-13525

The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTablesAjax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

BIT-PROCESSMAKER-2020-13526

SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. The reportTablesAjax and clientSetupAjax pages are vulnerable to SQL injection in the sort parameter.An attacker can make an authenticated HTT...

BIT-PROCESSMAKER-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

Exploit for Improper Preservation of Permissions in Processmaker

This repository has be archived and moved to: https://github.com...

ProcessMaker Privilege Escalation Exploit

Exploit Title: ProcessMaker - User Profile Privilege Escalation Description: ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators. Exploit Author: Sornram Kampeera...

ProcessMaker Privilege Escalation

Exploit Title: ProcessMaker - User Profile Privilege Escalation Description: ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators. Date: 20220822 Exploit Author: Sornram...

CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

Design/Logic Flaw

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

CVE-2022-38577

ProcessMaker before v3.5.4 has an insecure permission issue on the user profile page that lets normal users escalate to Administrators. This is documented across multiple sources (NVD/Red Hat/OSV) and is the same CVE entry, CVE-2022-38577. The Red Hat data additionally notes a related unrestricte...

CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

CVE-2022-38577: Improper Preservation of Permissions

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

ProcessMaker 权限许可和访问控制问题漏洞

ProcessMaker is a Php-written website builder for business process management BPM and workflow management from ProcessMaker Inc. in the United States. A security vulnerability exists in ProcessMaker prior to version v3.5.4, which stems from an insecure privilege in its user profile page that allo...

PT-2022-24467 · Unknown · Processmaker

Name of the Vulnerable Software and Affected Versions: ProcessMaker versions prior to 3.5.4 Description: The issue is related to insecure permissions in the user profile page, allowing attackers to escalate normal users to Administrators. Recommendations: For versions prior to 3.5.4, update to...

ProcessMaker 3.5.4 Local File Inclusion

Exploit Title: ProcessMaker 3.5.4 - Local File inclusion Exploit Author: Ai Ho @j3ssiejjj Date: 16-04-2021 Vendor Homepage: https://www.processmaker.com/ Version: ProcessMaker = 3.5.4 References: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/process-maker-lfi.yaml PoC: Wi...