Description
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowring Technology | Agentflow 4.0 | < 2025/08/08 | 2025/08/08 |
References
- https://zuso.ai/cve-advisory/advisory third-party-advisory