Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: Flowring Technology Corp Clear all filters
TI-2026-63779 CVE-2026-96440 · GHSA-4f4p-4qgh-w24r

Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Priority LOW 31

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00292 Published 2026-09-29 Fixed in 2023/03/24 CWE-22
TI-2026-63778 CVE-2026-96431 · GHSA-gchq-2h86-x245

Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

Priority MEDIUM 42

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system com…

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.003 Published 2026-09-29 Fixed in 2023/03/24 CWE-434
TI-2026-63777 CVE-2026-96430 · GHSA-9cc7-6f9h-3f3m

Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

Priority LOW 39

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00226 Published 2026-09-29 Fixed in 2026/08/28 CWE-749
TI-2026-63776 CVE-2026-96429 · GHSA-w2fh-g9qg-xq8x

Flowring Agentflow 4.0 - SQL Injection

Priority MEDIUM 48

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00277 Published 2026-09-29 Fixed in 2025/08/08 CWE-89
TI-2026-63775 CVE-2026-96428 · GHSA-m6wc-2jg2-2vh5

Flowring Agentflow 4.0 - SQL Injection

Priority MEDIUM 48

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00342 Published 2026-09-29 Fixed in 2025/08/08 CWE-89
TI-2025-10910 CVE-2025-11899 · GHSA-p79h-rmmr-jmr7

Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key

Priority MEDIUM 43

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00674 Published 2025-10-17 No fix listed CWE-321