EasyFlow .NET CVE-2026-12580

Q: What is the CVSS score of CVE-2026-12580?

CVE-2026-12580 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38222 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 twcert

GHSA-x6g3-x68w-mv5x

XSS Easyflow Net Digiwin

5.1

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable stored XSS requiring low-privilege auth (PR:L) and passive victim page load (UI:R); scope change to browser session (S:C) with low C/I impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 10:17 vuln.today

DescriptionCVE.org

EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load.

AnalysisAI

Stored Cross-Site Scripting in Digiwin's EasyFlow .NET workflow platform enables authenticated low-privilege attackers to inject persistent JavaScript that executes in other users' browsers on page load. The CVSS 4.0 vector (PR:L/UI:P/SC:L/SI:L) confirms the attacker requires a valid low-privilege account to plant the payload, while victims trigger execution passively by navigating to affected pages - including administrators who may have elevated session privileges worth hijacking. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world risk in the medium tier, concentrated in multi-tenant or shared-user deployments.

Technical ContextAI

EasyFlow .NET is a business process and workflow automation platform developed by Digiwin, a Taiwanese enterprise software vendor. The CPE string cpe:2.3:a:digiwin:easyflow_.net:*:*:*:*:*:*:*:* carries a wildcard version field, indicating no specific version boundary has been established and all tracked releases of the product may be affected. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of user-supplied data before it is persisted and subsequently rendered in an HTML context. The 'Stored' (Persistent) XSS variant is more severe than Reflected XSS because the payload survives between sessions on the server, executing automatically for every user who loads the affected page without requiring the attacker to repeatedly deliver a crafted link. The CVSS 4.0 subsequent-system impact metrics (SC:L/SI:L) correctly model that the server itself is not directly compromised - rather, other users' browser sessions bear the confidentiality and integrity impact.

RemediationAI

Consult the TWCERT English advisory at https://www.twcert.org.tw/en/cp-139-10981-8617d-2.html for the vendor-issued patch; no exact fixed version number is confirmed in the available intelligence data and the patch status should be verified directly with Digiwin before assuming coverage. As compensating controls pending patching, restrict EasyFlow .NET access to trusted internal networks or VPN-authenticated sessions to reduce the pool of low-privilege accounts that could plant payloads - trade-off is reduced accessibility for remote workers. Deploy a Content Security Policy (CSP) header with a strict script-src directive to limit inline script execution, noting this may break existing application JavaScript and requires testing. Audit existing stored content in user-editable fields for suspicious script tags or event handlers. Enforce role-based access controls to limit which users can submit rich or unstructured content to shared application fields, reducing attacker surface without full remediation.