CVE-2026-107803

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.

• CWE-89

• https://github.com/ProcessMaker/processmaker/commit/2622b7ae810e02c47157028331c45470567e7b79
• https://github.com/ProcessMaker/processmaker/pull/9041
• https://github.com/ProcessMaker/processmaker/releases/tag/v2026.14.3
• https://github.com/ProcessMaker/processmaker/security/advisories/GHSA-xf7p-gp7c-w7gh

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107799Jivejdon through 5.0 contains a stored cross-site scripting …5.4
• CVE-2026-1078An arbitrary file-write vulnerability in Pega Browser Extens…7.2
• CVE-2026-10780The Static Block plugin for WordPress is vulnerable to Insec…4.3
• CVE-2026-107800Jivejdon through 5.0 contains a stored cross-site scripting …5.4
• CVE-2026-107801Jivejdon through 5.0 contains a stored cross-site scripting …5.4
• CVE-2026-107802SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…7.1
• CVE-2026-107804Nginx UI is a web user interface for the Nginx web server. F…5.3
• CVE-2026-107805Nginx UI is a web user interface for the Nginx web server. F…7.5
• CVE-2026-107806Nginx UI is a web user interface for the Nginx web server. F…9.4
• CVE-2026-107807Nginx UI is a web user interface for the Nginx web server. F…8.8
• CVE-2026-107808Nginx UI is a web user interface for the Nginx web server. F…8.1
• CVE-2026-107809Nginx UI is a web user interface for the Nginx web server. F…8.8