ProcessMaker vulnerabilities

Products

• processmaker 3

Latest ProcessMaker CVEs

Newest publication first

1. CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

   Published 2026-10-09

   Medium·CVSS 6.5

   ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering() conca...

2. CVE-2016-9045 A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being execut...

   Published 2018-09-17

   High·CVSS 8.8

   A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability.

3. CVE-2016-9048 Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request...

   Published 2018-09-10

   High·CVSS 7.4

   Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.