CVE-2026-5963
Full vulnerability record from the local CVENow database.
Description
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-20 08:16:10.653000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-5963",
"sourceIdentifier": "[email protected]",
"published": "2026-04-20T08:16:10.653",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents."
},
{
"lang": "es",
"value": "EasyFlow .NET desarrollado por Digiwin tiene una vulnerabilidad de inyección SQL, permitiendo a atacantes remotos no autenticados inyectar comandos SQL arbitrarios para leer, modificar y eliminar contenidos de la base de datos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Digiwin",
"product": "EasyFlow .NET",
"defaultStatus": "unaffected",
"versions": [
{
"version": "6.1.*",
"status": "affected"
},
{
"version": "6.6.*",
"status": "affected"
},
{
"version": "8.1.1",
"lessThanOrEqual": "8.1.4",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-20T13:41:55.563772Z",
"id": "CVE-2026-5963",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:digiwin:easyflow_.net:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.0",
"versionEndIncluding": "6.6.17",
"matchCriteriaId": "2A246699-9391-4AA8-B25F-D93F5044BAC7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:digiwin:easyflow_.net:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "168660A8-9534-4246-9637-72960BF9A7B4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:digiwin:easyflow_.net:8.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "037A27C5-46DC-482D-B371-1C2699B0A083"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:digiwin:easyflow_.net:8.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BB1212AB-94B2-4F58-A7B2-0148F6021CBA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:digiwin:easyflow_.net:8.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F9D69FCA-503E-4A49-95C4-7BEF18C81E50"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:digiwin:easyflow_.net:8.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E10CB16D-1F6A-4A7A-AB87-1059E0D601CD"
}
]
}
]
}
],
"references": [
{
"url": "https://www.twcert.org.tw/en/cp-139-10832-05f3a-2.html",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.twcert.org.tw/tw/cp-132-10831-a734d-1.html",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}