CVE-2026-113407: YS-infoware｜BA-Workflow - SQL Injection

Published Oct 20, 2026

Updated

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

Affected Software

1 affected component

YS-infoware BA-Workflow

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade YS-infoware BA-Workflow to a version that resolves this vulnerability.
Fixed in v3.6.2.7

Event History

Oct 20, 2026

CVE Published

via MITRE·07:21 AM

Data Sourced

via MITRE·07:21 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Event

via NVD·09:06 AM

Frequently Asked Questions

Does exploitation require user interaction or a complex attack setup?

No user interaction is required. The CVSS vector indicates low attack complexity.

What level of access must an attacker have?

The attacker must be authenticated and have low-level privileges. The vulnerability is remotely exploitable over the network.