Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21

Export CSV
CVE-2026-102459

DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-102454

DigiWin｜EasyFlow .NET - Arbitrary File Upload

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-102455

DigiWin｜EasyFlow .NET - Insecure Deserialization

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-102456

DigiWin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-102457

DigiWin｜EasyFlow .NET - Arbitrary File Read

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-102458

DigiWin｜EasyFlow .NET - Missing Authentication

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-12580

Digiwin｜EasyFlow .NET - Stored Cross-Site Scripting

EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-12581

Digiwin｜EasyFlow .NET - Session Fixation

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-5963

Digiwin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2026-5964

Digiwin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2025-13165

Digiwin｜EasyFlow GP - Denial of service

EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in denial of web service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow Gp
CVE-2024-4893

DigiWin EasyFlow .NET - SQL Injection

DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2024-5311

DigiWin EasyFlow .NET - SQL Injection

DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database records.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2025-11949

Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication

EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2025-12503

Digiwin｜EasyFlow .NET and EasyFlow AiNet

EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2025-13163

Digiwin｜EasyFlow GP - Insufficiently Protected Credentials

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow Gp
CVE-2025-13164

Digiwin｜EasyFlow GP - Insufficiently Protected Credentials

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow Gp
CVE-2022-32458

Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Digiwin
Products
Business Process Management
CVE-2022-32457

Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)

Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Business Process Management
CVE-2022-32456

Data Systems Consulting Co., Ltd. BPM - SQL Injection

Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Digiwin
Products
Business Process Management