TIM Solutions TIM Flow vulnerabilities

Latest TIM Solutions TIM Flow CVEs

Newest publication first

1. CVE-2026-39914 TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint

   Published 2026-08-24

   High·CVSS 7.1 EPSS 0.38%

   TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries...

2. CVE-2026-39915 TIM Flow < 26.0.6 CRLF Injection via rt Parameter

   Published 2026-08-24

   High·CVSS 8.5 EPSS 0.48%

   TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie resp...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.