CVE-2026-96430
HighCVSS 8.7Summary
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to compromise of data confidentiality, integrity, and availability.
Recommendation
Update Flowring Agentflow to a version after 2026/08/28 or apply vendor patches.
Other vulnerabilities in Flowring Agentflow
See all- CVE-2026-96440High
Path Traversal vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.
- CVE-2026-96431Critical
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
- CVE-2026-96429Critical
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2026-96428Critical
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
Original NVD description (English source)
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS