Processmaker vulnerabilities

Products

• Processmaker 9
• Enterprise 2

Newest

• processmaker ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter CVE-2026-107803 6.5 MediumOctober 9, 2026
• processmaker ProcessMaker 3.5.4 Local File Inclusion via Path Traversal CVE-2021-47978 6.9 MediumMay 16, 2026
• processmaker ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE CVE-2025-34097 Public exploit 8.6 HighJuly 10, 2025
• processmaker Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote... CVE-2024-25506 6.5 MediumMarch 28, 2024
• processmaker ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile... CVE-2022-38577 Public exploitFix available 8.8 HighSeptember 19, 2022
• processmaker SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A... CVE-2020-13526 6.4 MediumDecember 10, 2020
• processmaker The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax... CVE-2020-13525 6.4 MediumDecember 3, 2020
• processmaker, processmaker enterprise +1 more A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A... CVE-2016-9045 8.8 HighSeptember 17, 2018
• processmaker, processmaker enterprise +1 more Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7... CVE-2016-9048 7.4 HighSeptember 10, 2018