CVE-2025-13163: Digiwin｜EasyFlow GP - Insufficiently Protected Credentials

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-17 · updated 2026-10-07
Weakness: CWE-522

Description

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.

Affected products

Digiwin EasyFlow GP: from 5.8.8.3 through 5.8.11.1.0810112; from 8.1.* through 8.1.1.2

References

https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html
https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html

Get alerted when CVE-2025-13163 or the next vulnerability affects your stack