{"items":[{"id":"CVE-2026-107803","published":"2026-10-09T13:40:16.993Z","updated":"2026-10-09T17:32:10.883Z","title":"ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter","severity":"MEDIUM","score":6.5,"vendor":"ProcessMaker","product":"processmaker","kev":false,"epss":0.00249,"kevAdded":null,"exploit":false},{"id":"CVE-2021-47978","published":"2026-05-16T15:28:14.305Z","updated":"2026-05-18T17:53:17.293Z","title":"ProcessMaker 3.5.4 Local File Inclusion via Path Traversal","severity":"MEDIUM","score":6.9,"vendor":"Processmaker","product":"ProcessMaker","kev":false,"epss":0.00776,"kevAdded":null,"exploit":true},{"id":"CVE-2016-9045","published":"2018-09-17T15:00:00.000Z","updated":"2024-09-16T23:25:25.869Z","title":"A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization…","severity":"HIGH","score":8.8,"vendor":"ProcessMaker","product":"ProcessMaker Enterprise","kev":false,"epss":0.02211,"kevAdded":null,"exploit":false},{"id":"CVE-2016-9048","published":"2018-09-10T16:00:00.000Z","updated":"2024-09-16T22:40:42.051Z","title":"Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL…","severity":"HIGH","score":7.4,"vendor":"ProcessMaker","product":"ProcessMaker Enterprise","kev":false,"epss":0.00798,"kevAdded":null,"exploit":false}]}