CVE-2026-12581
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. Unauthenticated remote attackers can replace a specific session ID for a user, allowing them to gain the user's privileges once the user logs in.
Risk Assessment
Attackers can take control of a user's account, leading to unauthorized access to system data and functions. This can result in serious security implications for the organization.
Recommendation
It is recommended to implement protections against Session Fixation attacks, such as regenerating session IDs upon login. Additionally, monitoring and analyzing user session logs is advised.
Other vulnerabilities in EasyFlow .NET
See all- CVE-2026-5964Critical
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- CVE-2026-5963Critical
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- CVE-2026-12580Medium
EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load.
Original NVD description (English source)
EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.