Skip to content
OpenAdvisories

Vendor

Flowring

18 known vulnerabilities.

Products

Agentflow 8 Agentflow 4.0 5 Agentflow BPM 3 Docpedia 2
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-96431

    Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

    Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.

    Flowring Agentflow 4.0
  • Critical 9.3
    CVE-2026-96429

    Flowring Agentflow 4.0 - SQL Injection

    SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Flowring Agentflow 4.0
  • Critical 9.3
    CVE-2026-96428

    Flowring Agentflow 4.0 - SQL Injection

    SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.

    Flowring Agentflow 4.0
  • Critical 9.8
    CVE-2026-2096

    Flowring｜Agentflow - Missing Authenticaton

    Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.

    Flowring Agentflow
  • Critical 9.8
    CVE-2026-2095

    Flowring｜Agentflow - Authentication Bypass

    Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.

    Flowring Agentflow
  • Critical 9.8
    CVE-2025-3709

    Flowring Technology Agentflow - Account Lockout Bypass

    Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.

    Flowring Agentflow
  • Critical 9.8
    CVE-2022-39036

    FLOWRING Agentflow BPM - Arbitrary File Upload

    The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.

    Flowring Agentflow BPM