CVE-2026-96429
CriticalCVSS 9.3Summary
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Risk Assessment
A remote attacker can execute arbitrary SQL commands, potentially leading to data leakage, modification or deletion of database contents, and further privilege escalation.
Recommendation
Update Flowring Agentflow 4.0 to version 2025/08/08 or later and implement input validation and parameterized SQL queries in the API.
Other vulnerabilities in Flowring Agentflow
See all- CVE-2026-96440High
Path Traversal vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.
- CVE-2026-96430High
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.
- CVE-2026-96431Critical
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
- CVE-2026-96428Critical
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
Original NVD description (English source)
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS