CVE-2025-67281
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-09

Last updated on: 2026-01-09

Assigner: MITRE

Description
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-09
Last Modified
2026-01-09
Generated
2026-06-16
AI Q&A
2026-01-10
EPSS Evaluated
2026-06-14
NVD
CVE-2025-67281
EUVD
EUVD-2026-1728
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
tim_solutions_gmbh tim_bpm_suite 9.1.2
tim_solutions_gmbh tim_bpm_suite to 9.1.2 (exc)
tim_solutions_gmbh tim_flow 9.1.2
tim_solutions_gmbh tim_flow to 9.1.2 (exc)
wildfly wildfly 37.0.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-67281 is a SQL injection vulnerability in TIM BPM Suite and TIM FLOW versions up to 9.1.2. It allows both low-privileged and administrative users to execute malicious SQL code, which can give them unauthorized access to the database and its contents. [2]

Impact Analysis

This vulnerability can allow attackers with low or administrative privileges to access sensitive data stored in the database, potentially leading to data leakage, unauthorized data modification, and compromise of the integrity and confidentiality of business process information. [2]

Mitigation Strategies

Immediate mitigation steps include applying the vendor's announced patches that remediate these vulnerabilities. Additionally, it is recommended to follow OWASP guidelines such as the SQL Injection Prevention Cheat Sheet, Authorization Cheat Sheet, and Password Storage Cheat Sheet to enhance security and reduce risk. [2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-67281. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart