In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.
References
| Link | Resource |
|---|---|
| https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes | Release Notes |
| https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities/ | Third Party Advisory |
Configurations
History
22 Jan 2026, 21:35
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:tim-solutions:tim_flow:*:*:*:*:*:*:*:* | |
| First Time |
Tim-solutions
Tim-solutions tim Flow |
|
| References | () https://tim-doc.atlassian.net/wiki/spaces/eng/pages/230981636/Release+Notes - Release Notes | |
| References | () https://www.y-security.de/news-en/tim-bpm-suite-tim-flow-multiple-vulnerabilities/ - Third Party Advisory |
09 Jan 2026, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CWE | CWE-89 |
09 Jan 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-09 16:16
Updated : 2026-01-22 21:35
NVD link : CVE-2025-67281
Mitre link : CVE-2025-67281
CVE.ORG link : CVE-2025-67281
JSON object : View
Products Affected
tim-solutions
- tim_flow
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')