ProcessMaker Vulnerabilities and Affected Products
Vulnerabilities associated with ProcessMaker.
Products
Clear product- ProcessMaker2 vulnerabilities
- ProcessMaker Enterprise2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-47978MEDIUM | ProcessMaker 3.5.4 Local File Inclusion via Path TraversalProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without authentication. CWE-98May 16, 2026 | CVSS6.9v4.0 | EPSS0.776% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-25506MEDIUM | Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pm_sys_sys cookie. CWE-79Mar 28, 2024 | CVSS6.5v3.1 | EPSS0.347% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |