Business Process Management vulnerabilities

2 known vulnerabilities in Business Process Management from DigiWin. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  BPM: Improper Restriction of XML External Entity Reference

  CVE-2022-32458Jul 20, 2022Data Systems ConsultingEPSS 1.13%

  Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

• 9.8 Critical severity

  BPM: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-32456Jul 20, 2022Data Systems ConsultingEPSS 1.64%

  Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.