SQL Injection Vulnerability in EasyFlow .NET by Digiwin
CVE-2026-102456

7.1HIGH

Key Information:

Vendor

Digiwin

Status
Easyflow .net
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102456?

EasyFlow .NET, developed by Digiwin, has been identified with a significant SQL Injection vulnerability. This flaw allows authenticated remote attackers to exploit the system by injecting arbitrary SQL commands. Such an attack compromises the database, enabling attackers to read sensitive information stored within. Organizations using EasyFlow .NET should take immediate action to address this vulnerability to safeguard their data and ensure the integrity of their systems.

Affected Version(s)

EasyFlow .NET 6.1.*

EasyFlow .NET 6.6 <= 6.6.19

EasyFlow .NET 8.1 <= 8.1.5

References

https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.