CVE-2026-102459 is a reflected cross-site scripting vulnerability in DigiWin EasyFlow .NET. The flaw arises from improper neutralization of input during web page generation, enabling unauthenticated remote attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser. This can be exploited through phishing attacks to compromise user sessions or perform other malicious actions within the browser context. The vulnerability affects versions >=6.6 <=6.6.19, >=8.1 <=8.1.5, and >=6.1.0 <6.2.0 of EasyFlow .NET. No known exploits are reported in the wild, and no vendor patch or remediation information is provided in the input data.

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser without authentication, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability requires user interaction (phishing) and does not provide direct system-level access or privilege escalation. The CVSS score of 5.1 reflects a medium impact primarily on confidentiality and integrity at the client side.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should exercise caution with unsolicited links and phishing attempts targeting EasyFlow .NET users. Monitor vendor communications for updates on patches or official mitigations.