CVE-2025-67280

Description

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.

PUBLISHED Reserved 2025-12-08 | Published 2026-01-09 | Updated 2026-01-09 | Assigner mitre

References

tim-doc.atlassian.net/...s/eng/pages/230981636/Release+Notes

www.y-security.de/...uite-tim-flow-multiple-vulnerabilities/

cve.org (CVE-2025-67280)

nvd.nist.gov (CVE-2025-67280)

Download JSON