Description
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API
endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows
remote attackers to execute arbitrary SQL commands via the id parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowring Technology | Agentflow 4.0 | < 2025/08/08 | 2025/08/08 |
References
- https://zuso.ai/cve-advisory/advisory third-party-advisory