What’s Vulnerable › Vulnerabilities

CVE-2025-13164: Digiwin｜EasyFlow GP - Insufficiently Protected Credentials

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-17 · updated 2026-10-07
• Weakness: CWE-522

Description

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.

Affected products

• Digiwin EasyFlow GP: from 5.8.8.3 through 5.8.11.1.0810112

References

• https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html
• https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html

Get alerted when CVE-2025-13164 or the next vulnerability affects your stack