Threats affecting pkg:maven/com.timsolution/tim-bpm-suite

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.4	EPSS 0.2%	CVE-2025-67280tim-bpm-suite · SQL Injection: Hibernate Medium5.4EPSS 0.2%2026-01-09CVE Database V5CVE-2025-67280 In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user. EPSS 0.2%Vulnerability CWE-564	CVE Database V5	2026-01-09
Medium	5.3	EPSS 0.3%	CVE-2025-67279tim-bpm-suite · Incorrect Privilege Assignment Medium5.3EPSS 0.3%2026-01-09CVE Database V5CVE-2025-67279 An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format EPSS 0.3%Vulnerability CWE-266	CVE Database V5	2026-01-09
Medium	6.5	EPSS 0.3%	CVE-2025-67278tim-bpm-suite · Incorrect Privilege Assignment Medium6.5EPSS 0.3%2026-01-09CVE Database V5CVE-2025-67278 An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request EPSS 0.3%Vulnerability CWE-266	CVE Database V5	2026-01-09

Page 1 of 1