Skip to content
OpenAdvisories

Vendor

DigiWin

22 known vulnerabilities.

Products

EasyFlow .NET 15 EasyFlow GP 3 EasyFlow AiNet 2 ERP 2 SFT 1 EAI 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-102459

    DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting

    EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks.

    DigiWin EasyFlow .NET
  • Medium 6.5
    CVE-2026-102457

    DigiWin｜EasyFlow .NET - Arbitrary File Read

    EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.

    DigiWin EasyFlow .NET
  • Medium 6.5
    CVE-2026-102456

    DigiWin｜EasyFlow .NET - SQL Injection

    EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.

    DigiWin EasyFlow .NET
  • Medium 5.4
    CVE-2026-12580

    Digiwin｜EasyFlow .NET - Stored Cross-Site Scripting

    EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load.

    DigiWin EasyFlow .NET
  • Medium 4.9
    CVE-2025-13164

    Digiwin｜EasyFlow GP - Insufficiently Protected Credentials

    EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.

    DigiWin EasyFlow GP
  • Medium 4.9
    CVE-2025-13163

    Digiwin｜EasyFlow GP - Insufficiently Protected Credentials

    EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.

    DigiWin EasyFlow GP
  • Medium 6.5
    CVE-2025-12503

    Digiwin｜EasyFlow .NET and EasyFlow AiNet

    EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

    DigiWin EasyFlow .NET EasyFlow AiNet
  • Medium 6.3
    CVE-2025-2706

    Digiwin ERP UploadAjaxAPI.ashx unrestricted upload

    A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx. The manipulation of the argument File leads to unrestricted upload. The attack can b…

    DigiWin ERP
  • Medium 6.5
    CVE-2024-7323

    Digiwin EasyFlow .NET - Arbitrary File Download

    Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server…

    DigiWin EasyFlow .NET