In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
References
| Link | Resource |
|---|---|
| https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes | Release Notes |
| https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities/ | Third Party Advisory |
Configurations
History
22 Jan 2026, 21:33
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:tim-solutions:tim_flow:*:*:*:*:*:*:*:* | |
| References | () https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes - Release Notes | |
| References | () https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities/ - Third Party Advisory | |
| First Time |
Tim-solutions
Tim-solutions tim Flow |
09 Jan 2026, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-564 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
09 Jan 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-09 16:16
Updated : 2026-01-22 21:33
NVD link : CVE-2025-67280
Mitre link : CVE-2025-67280
CVE.ORG link : CVE-2025-67280
JSON object : View
Products Affected
tim-solutions
- tim_flow
CWE
CWE-564
SQL Injection: Hibernate