Digiwin Easyflow .net vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Digiwin Easyflow .net: 6 record(s), with affected versions and fixes.cpe:2.3:a:digiwin:easyflow_.net
CVE-2026-12581
High · 7.5
CWE-384 Jun 22, 2026
Digiwin｜EasyFlow .NET - Session Fixation
EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.
CVE-2026-12580
Medium · 5.4
CWE-79 Jun 22, 2026
Digiwin｜EasyFlow .NET - Stored Cross-Site Scripting
EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load.
CVE-2026-5964
Critical · 9.8
CWE-89 Apr 20, 2026
Digiwin｜EasyFlow .NET - SQL Injection
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2026-5963
Critical · 9.8
CWE-89 Apr 20, 2026
Digiwin｜EasyFlow .NET - SQL Injection
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2025-12503
Medium · 6.5
CWE-89 Nov 3, 2025
Digiwin｜EasyFlow .NET and EasyFlow AiNet
EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2025-11949
High · 7.5
CWE-306 Oct 21, 2025
Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication
EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.