CVE-2026-5963: Digiwin｜EasyFlow .NET - SQL Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-20 · updated 2026-10-26
Weakness: CWE-89

Description

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Affected products

DigiWin EasyFlow .NET: from 6.6.0 through 6.6.17; 6.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4

References

https://www.twcert.org.tw/en/cp-139-10832-05f3a-2.html
https://www.twcert.org.tw/tw/cp-132-10831-a734d-1.html

Get alerted when CVE-2026-5963 or the next vulnerability affects your stack