CVE-2025-12503: Digiwin｜EasyFlow .NET and EasyFlow AiNet

Published Nov 3, 2025

Updated

EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

Affected Software

2 affected components

Digiwin EasyFlow .NET

Digiwin EasyFlow AiNet

Remediation

Information

Update EasyFlow.NET to version 6.6.19 and install the patch 20250520 Update EasyFlow AiNet to version 8.1.1 and install the patch 20250520

Event History

Nov 3, 2025

CVE Published

via MITRE·06:51 AM

Data Sourced

via MITRE·06:51 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-12503?

CVE-2025-12503 is classified as a high severity vulnerability due to its ability to allow authenticated remote attackers to execute arbitrary SQL commands.

How do I fix CVE-2025-12503?

To fix CVE-2025-12503, you should update to the latest version of Digiwin EasyFlow .NET or Digiwin EasyFlow AiNet where the vulnerability has been addressed.

What type of vulnerability is CVE-2025-12503?

CVE-2025-12503 is a SQL Injection vulnerability which allows attackers to manipulate SQL queries executed by the application.

Who is affected by CVE-2025-12503?

CVE-2025-12503 affects users of Digiwin EasyFlow .NET and Digiwin EasyFlow AiNet applications.

Can CVE-2025-12503 lead to data exposure?

Yes, CVE-2025-12503 can lead to data exposure as it allows attackers to read sensitive database contents through SQL injection.