CVE-2026-113405: YS-infoware｜BA-Workflow - SQL Injection
Published Oct 20, 2026
·Updated
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
Affected Software
1 affected component
YS-infoware BA-Workflow
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YS-infoware BA-Workflowto a version that resolves this vulnerability.Fixed in v3.6.2.7
Event History
Oct 20, 2026
CVE Published
via MITRE·07:17 AM
Data Sourced
via MITRE·07:17 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must be authenticated to BA-Workflow and able to reach the affected application remotely. No user interaction is required.
2
What could an attacker do after exploiting it?
The attacker can inject arbitrary SQL statements, allowing them to read, modify, or delete database contents.
3
Is an unauthenticated default deployment affected?
The available information identifies exploitation as requiring authenticated access. It does not state whether any particular default configuration is affected.