CVE-2025-67281

Medium · 5.4

CVSS

5.4

EPSS

0.2%

Published

Jan 9, 2026

CISA due date

—

The record

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.

Affected packages

Ecosystem	Package	Introduced	Fixed