CVE-2026-5964

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5964", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2026-04-09T10:34:41.136Z", "datePublished": "2026-04-20T07:36:58.476Z", "dateUpdated": "2026-04-20T13:38:08.600Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-04-20T07:36:58.476Z"}, "title": "Digiwin\uff5cEasyFlow .NET - SQL Injection", "datePublic": "2026-04-20T07:33:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "affected": [{"vendor": "Digiwin", "product": "EasyFlow .NET", "versions": [{"status": "affected", "version": "6.1.*"}, {"status": "affected", "version": "6.6.*"}, {"status": "affected", "version": "8.1.1", "lessThanOrEqual": "8.1.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents."}]}], "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-10831-a734d-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-10832-05f3a-2.html", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Update to version 8.1.3 or later, or install patch 2025/07/15.", "supportingMedia": [{"type": "text/html", "base64": false, "value": " Update to version 8.1.3 or later, or install patch 2025/07/15."}]}], "source": {"advisory": "TVN-202604006", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T13:38:00.563928Z", "id": "CVE-2026-5964", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:38:08.600Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5964", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T13:38:00.563928Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:38:04.893Z"}}], "cna": {"title": "Digiwin\uff5cEasyFlow .NET - SQL Injection", "source": {"advisory": "TVN-202604006", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Digiwin", "product": "EasyFlow .NET", "versions": [{"status": "affected", "version": "6.1.*"}, {"status": "affected", "version": "6.6.*"}, {"status": "affected", "version": "8.1.1", "versionType": "custom", "lessThanOrEqual": "8.1.2"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to version 8.1.3 or later, or install patch 2025/07/15.", "supportingMedia": [{"type": "text/html", "value": " Update to version 8.1.3 or later, or install patch 2025/07/15.", "base64": false}]}], "datePublic": "2026-04-20T07:33:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-10831-a734d-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-10832-05f3a-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.", "supportingMedia": [{"type": "text/html", "value": "EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2026-04-20T07:36:58.476Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5964", "state": "PUBLISHED", "dateUpdated": "2026-04-20T13:38:08.600Z", "dateReserved": "2026-04-09T10:34:41.136Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2026-04-20T07:36:58.476Z", "assignerShortName": "twcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EasyFlow .NET", "vendor": "Digiwin", "versions": [{"status": "affected", "version": "6.1.*"}, {"status": "affected", "version": "6.6.*"}, {"lessThanOrEqual": "8.1.2", "status": "affected", "version": "8.1.1", "versionType": "custom"}]}], "source": "twcert@cert.org.tw"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:digiwin:easyflow_.net:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A246699-9391-4AA8-B25F-D93F5044BAC7", "versionEndIncluding": "6.6.17", "versionStartIncluding": "6.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:digiwin:easyflow_.net:6.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "168660A8-9534-4246-9637-72960BF9A7B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:digiwin:easyflow_.net:8.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "037A27C5-46DC-482D-B371-1C2699B0A083", "vulnerable": true}, {"criteria": "cpe:2.3:a:digiwin:easyflow_.net:8.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "BB1212AB-94B2-4F58-A7B2-0148F6021CBA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents."}, {"lang": "es", "value": "EasyFlow .NET desarrollado por Digiwin tiene una vulnerabilidad de inyecci\u00f3n SQL, permitiendo a atacantes remotos no autenticados inyectar comandos SQL arbitrarios para leer, modificar y eliminar contenidos de la base de datos."}], "id": "CVE-2026-5964", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "twcert@cert.org.tw", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5964", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T13:38:00.563928Z", "version": "2.0.3"}}]}, "published": "2026-04-20T08:16:10.850", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/en/cp-139-10832-05f3a-2.html"}, {"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-10831-a734d-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,6.2.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.0,6.7.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.1.1,8.1.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "EasyFlow .NET", "source": "cna", "vendor": "Digiwin"}, "product": "easyflow_.net", "vendor": "digiwin"}], "analysis": {"en": {"generated_at": "2026-04-20T08:20:59.464347+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch or upgrade to EasyFlow .NET version 8.1.3 or later.", "Apply the 2025/07/15 patch if the standalone patch is required.", "Restrict the database user permissions to the minimum necessary for normal application operations."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized database access and modification"}, "threat_synthesis": {"affected_systems": "The affected product is Digiwin EasyFlow .NET, with versions older than 8.1.3 subject to the vulnerability. Applying the official patch from 2025/07/15 or upgrading to any release 8.1.3 or later resolves the flaw.", "description_and_impact": "Digiwin EasyFlow .NET contains a SQL Injection flaw (CWE\u201189) that permits unauthenticated remote attackers to embed arbitrary SQL statements, enabling them to read, alter, or delete data stored in the application database. The attacker can thus exfiltrate sensitive information or corrupt business records, potentially disrupting operations.", "risk_and_exploitability": "The CVSS score of 9.3 indicates critical severity, and while the EPSS score is not available, the lack of KEV listing suggests no widespread exploitation yet. Nevertheless, the unauthenticated remote nature of the attack vector poses a high risk of data theft or loss, and organizations should treat this as a top\u2011priority issue."}}}}, "created": "2026-04-20T08:30:02.449317+00:00", "updated": "2026-04-20T08:30:02.620572+00:00", "vendors": ["digiwin", "digiwin$PRODUCT$easyflow_.net"]}