CVE-2026-12581 | High | 7.5 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can… |
CVE-2026-12580 | Medium | 5.4 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript cod… |
CVE-2026-5964 | Critical | 9.8 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modif… |
CVE-2026-5963 | Critical | 9.8 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modif… |
CVE-2025-13165 | High | 7.5 | 2025-11-17 | EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in deni… |
CVE-2025-13164 | Medium | 4.9 | 2025-11-17 | EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credential… |
CVE-2025-13163 | Medium | 4.9 | 2025-11-17 | EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database a… |
CVE-2025-12503 | Medium | 6.5 | 2025-11-03 | EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL comman… |
CVE-2025-11949 | High | 7.5 | 2025-10-21 | EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain databas… |
CVE-2025-7344 | High | 8.8 | 2025-07-21 | The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to adminis… |
CVE-2025-7343 | Critical | 9.8 | 2025-07-21 | The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and… |
CVE-2025-2706 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/Uplo… |
CVE-2025-2705 | High | 7.3 | 2025-03-24 | A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. Th… |
CVE-2024-7323 | Medium | 6.5 | 2024-08-02 | Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with… |
CVE-2024-5311 | Critical | 9.8 | 2024-06-03 | DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and… |
CVE-2024-4893 | Critical | 9.8 | 2024-05-15 | DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables una… |
CVE-2022-32458 | High | 7.5 | 2022-07-20 | Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perfo… |
CVE-2022-32457 | Medium | 5.3 | 2022-07-20 | Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology… |
CVE-2022-32456 | Critical | 9.8 | 2022-07-20 | Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delet… |