Vendor
5 published CVES affecting nintex, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.
Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.