CVE-2026-96428: Flowring Agentflow 4.0 - SQL Injection
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is described as remotely exploitable through the /WebAgenda/SMBAjaxAutoComplete.do endpoint using the words parameter. The available information does not state that authentication or other prior access is required.
Which deployments should be treated as potentially affected?
Flowring Agentflow 4.0 deployments with versions dated before 2025/08/08 should be treated as potentially affected. The provided information does not identify configuration-dependent conditions or exclusions.
What is the potential impact of successful exploitation?
A remote attacker may be able to execute arbitrary SQL commands through the vulnerable parameter. The provided information does not specify the resulting database privileges, accessible data, or whether application-level code execution is possible.