CVE-2026-5963

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-59630In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection dueCVE-2026-596317.8In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalatCVE-2026-596327.5In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undrained message queue dCVE-2026-596357.8In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of priCVE-2026-596366.2In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-CVE-2026-596373.3In userdata_report of hwcodec_firmware, there is a possible Logic error due to a logic error in the code. This could lead to local informatiCVE-2026-596386.5In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affeCVE-2026-596397.5In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy CaCVE-2026-59649.8EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commCVE-2026-596405.3In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy CVE-2026-596415.3In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects BounCVE-2026-596427.5In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy
CVE-2026-5963: Critical severity, CVSS 9.8 | Vulnix