Threats affecting pkg:nuget/DigiWin/easyflow.net

7 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.1	EPSS 0.2%	CVE-2026-102459DigiWin EasyFlow .NET · Cross-site Scripting Medium5.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-102459 EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks. EPSS 0.2%Vulnerability CWE-79 #ghsa-76p6-4f24-6f89	CVE Database V5	2026-09-30
Critical	9.3	EPSS 0.4%	CVE-2026-102458DigiWin EasyFlow .NET · Missing Authentication Critical9.3EPSS 0.4%2026-09-30CVE Database V5CVE-2026-102458 EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API. EPSS 0.4%Vulnerability CWE-306 #ghsa-m83w-gfx5-2446	CVE Database V5	2026-09-30
High	7.1	EPSS 0.4%	CVE-2026-102457DigiWin EasyFlow .NET · Path Traversal High7.1EPSS 0.4%2026-09-30CVE Database V5CVE-2026-102457 EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files. EPSS 0.4%Vulnerability CWE-22 #ghsa-qg6g-m898-7whg	CVE Database V5	2026-09-30
High	7.1	EPSS 0.3%	CVE-2026-102456DigiWin EasyFlow .NET · SQL Injection High7.1EPSS 0.3%2026-09-30CVE Database V5CVE-2026-102456 EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents. EPSS 0.3%Vulnerability CWE-89 #ghsa-2vf8-v86v-cvww	CVE Database V5	2026-09-30
Critical	9.3	EPSS 0.5%	CVE-2026-102455DigiWin EasyFlow .NET · Deserialization of Untrusted Data Critical9.3EPSS 0.5%2026-09-30CVE Database V5CVE-2026-102455 EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content. EPSS 0.5%Vulnerability CWE-502 #ghsa-3r5f-hfpx-5qh5	CVE Database V5	2026-09-30
Critical	9.3	EPSS 0.4%	CVE-2026-5964Digiwin EasyFlow .NET · SQL Injection Critical9.3EPSS 0.4%2026-04-20CVE Database V5CVE-2026-5964 EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. EPSS 0.4%Vulnerability CWE-89	CVE Database V5	2026-04-20
Critical	9.3	EPSS 0.4%	CVE-2026-5963Digiwin EasyFlow .NET · SQL Injection Critical9.3EPSS 0.4%2026-04-20CVE Database V5CVE-2026-5963 EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. EPSS 0.4%Vulnerability CWE-89	CVE Database V5	2026-04-20

Page 1 of 1