How severe is CVE-2025-67280?

CVE-2025-67280 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-67280 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-67280?

CVE-2025-67280 affects Tim-solutions Tim Flow. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-67280?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-67280 have an EU (EUVD) identifier?

Yes. CVE-2025-67280 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1727.

When was CVE-2025-67280 published?

CVE-2025-67280 was published on 2026-01-09 and last updated on 2026-06-17.

CVE-2025-67280

CVE-2025-67280 is a medium-severity vulnerability in Tim-solutions Tim Flow with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-564.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-1727
Weakness: CWE-564
Affected product: Tim-solutions Tim Flow
Published: 2026-01-09
Last modified: 2026-06-17

Description

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.

Frequently asked questions

What is CVE-2025-67280?: In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
How severe is CVE-2025-67280?: CVE-2025-67280 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-67280 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-67280?: CVE-2025-67280 affects Tim-solutions Tim Flow. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-67280?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-67280 have an EU (EUVD) identifier?: Yes. CVE-2025-67280 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1727.
When was CVE-2025-67280 published?: CVE-2025-67280 was published on 2026-01-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:tim-solutions:tim_flow:*:*:*:*:*:*:*:*

More vulnerabilities in Tim-solutions Tim Flow

CVE-2025-67278 — Medium (CVSS 6.5): An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges…
CVE-2025-67282 — Medium (CVSS 5.4): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low…
CVE-2025-67281 — Medium (CVSS 5.4): In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and…
CVE-2025-67279 — Medium (CVSS 5.3): An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges…

All CVEs affecting Tim-solutions Tim Flow →

Other CWE-564 vulnerabilities

CVE-2025-8052 — High (CVSS 8.8): SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege…
CVE-2025-0959 — High (CVSS 8.8): The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the…
CVE-2024-58352 — High (CVSS 7.5): Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query…
CVE-2026-23959 — Medium (CVSS 4.9): CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in…

Browse all CWE-564 vulnerabilities →