CVE-2025-67282

TIM BPM Suite and TIM FLOW versions through 9.1.2 are affected by multiple authorization bypass vulnerabilities. These flaws allow a low privileged user to perform unauthorized actions, including downloading password hashes of other users, accessing private work items, modifying restricted workfl...

CVE-2025-67280

The business process management software TIM BPM Suite and TIM FLOW (versions through 9.1.2 ) are vulnerable to multiple Hibernate Query Language injection flaws. A low privileged user can exploit these vulnerabilities to extract passwords of other users and gain unauthorized access to sensitive ...

CVE-2025-67279

The business process management software TIM BPM Suite & TIM FLOW versions prior to v.9.1.2 from TIM Solution GmbH are vulnerable to a privilege escalation issue. The root cause is that the application stores password hashes in MD5 format , which a remote attacker can exploit to escalate privileg...

CVE-2025-67281

TIM BPM Suite and TIM FLOW (versions through 9.1.2 ) are impacted by multiple SQL injection vulnerabilities. These flaws allow both low-privileged and administrative users to gain unauthorized access to the database and its contents. Remediation involves updating the software to versions beyond 9...

CVE-2025-67278

An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before version v.9.1.2 allows a remote attacker to escalate privileges by sending a crafted HTTP request . This vulnerability is classified as an incorrect privilege assignment (CWE-266). To mitigate this risk, it is recommended to update to ...