CVE-2026-96428

Name of the Vulnerable Software and Affected Versions Flowring Agentflow version 4.0 prior to 2025/08/08

Description An issue exists in the '/WebAgenda/SMBAjaxAutoComplete.do' API endpoint that allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the words parameter. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update Flowring Agentflow version 4.0 to a version released on or after 2025/08/08. Avoid using the words parameter in the '/WebAgenda/SMBAjaxAutoComplete.do' API endpoint until the update is applied.