Skip to content
OpenAdvisories

Vendor

ProcessMaker

6 known vulnerabilities.

Products

processmaker 3 ProcessMaker Enterprise 2 ProcessMaker Open Source 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-107803

    ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

    ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::app…

    ProcessMaker processmaker
  • Medium 6.2
    CVE-2021-47978

    ProcessMaker 3.5.4 Local File Inclusion via Path Traversal

    ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive…

    ProcessMaker processmaker