EasyFlow .NET vulnerabilities
9 known vulnerabilities in EasyFlow .NET from DigiWin. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
EasyFlow .NET: Missing Authentication for Critical Functionality
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
- 9.8 Critical severity
EasyFlow .NET: Deserialization of Untrusted Data
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- 7.2 High severity
EasyFlow .NET: Unrestricted Upload of File with Dangerous Type
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- 7.5 High severity
EasyFlow .NET: Session Fixation
EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- 7.5 High severity
EasyFlow .NET: Missing Authentication for Critical Functionality
EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database records.
- 9.8 Critical severity
EasyFlow .NET: Improper Neutralization of Special Elements used in an SQL Command
DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands.