EUVD-2026-88658
GHSA-w2fh-g9qg-xq8x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SQLi with low complexity (PR:N/UI:N/AC:L); full DB read and write plus destructive/DoS potential justify C:H/I:H/A:H, scope unchanged as impact stays within the DB component.
Primary rating from Vendor (ZUSO ART).
CVSS VectorVendor: ZUSO ART
Lifecycle Timeline
3DescriptionCVE.org
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.
AnalysisAI
Unauthenticated SQL injection in Flowring Agentflow 4.0 lets remote attackers run arbitrary SQL commands against the application database through the id parameter of the /WebAgenda/SMBAjaxConfigProcess.do endpoint, giving full read/write access to back-end data as returned by the vulnerable query. Only deployments running a build older than the 2025/08/08 fixed release and exposing the WebAgenda API to the network are affected; the CVSS 4.0 base score of 9.3 and the parallel CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C/I/A:H) both reflect that no authentication, user interaction, or non-default configuration is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Flowring Agentflow 4.0, provided the /WebAgenda/SMBAjaxConfigProcess.do endpoint is network-reachable (PR:N/UI:N/AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a CVSS-inflation case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Flowring Agentflow to a build dated 2025/08/08 or later; that release is the vendor-designated fixed version for this issue, and no backport or hotfix is specified in the supplied references, so isolated parameter-level patches should not be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every internet- or partner-facing Flowring Agentflow 4.0 WebAgenda instance, capture its build number, and immediately block external access to /WebAgenda/SMBAjaxConfigProcess.do at the perimeter or reverse proxy; in parallel, rotate credentials for any database account used by Agentflow and review web and database logs for anomalous id parameters or unexpected SQL error responses over the last 30 days. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Agentflow 4 0
View allUnauthenticated SQL injection in Flowring Agentflow 4.0 allows any remote attacker who can reach the web interface to ex
Remote code execution in Flowring Agentflow 4.0 is possible through the /WebAgenda/download/uploadFile.jsp endpoint, whe
Authenticated remote attackers can execute arbitrary SQL commands against Flowring Agentflow 4.0 through the /WebAgenda/
Remote authenticated attackers can write files to arbitrary locations in Flowring Agentflow 4.0 via a path traversal fla
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today