DigiWin vulnerabilities
We track 15 vulnerabilities in DigiWin products across 7 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest DigiWin vulnerabilities
- 9.8 Critical severity
EasyFlow .NET: Missing Authentication for Critical Functionality
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- 9.8 Critical severity
EasyFlow .NET: Deserialization of Untrusted Data
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- 7.2 High severity
EasyFlow .NET: Unrestricted Upload of File with Dangerous Type
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 7.5 High severity
EasyFlow .NET: Session Fixation
EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- 7.5 High severity
EasyFlow GP: Allocation of Resources Without Limits or Throttling
EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests that result in denial of web service.
- 7.5 High severity
EasyFlow .NET: Missing Authentication for Critical Functionality
EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.
- 8.8 High severity
EAI: Incorrect Use of Privileged APIs
The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a specific API.
- 9.8 Critical severity
SFT: Improper Neutralization of Special Elements used in an SQL Command
The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- 7.3 High severity
ERP: Improper Access Control
A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database records.
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands.
- 7.5 High severity
BPM: Improper Restriction of XML External Entity Reference
Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
- 9.8 Critical severity
BPM: Improper Neutralization of Special Elements used in an SQL Command
Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.