Threat database

5 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	7.1	EPSS 0.3%	CVE-2026-96440Agentflow 4.0 · Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） High7.1EPSS 0.3%2026-09-29CVE Database V5CVE-2026-96440 CVE-2026-96440 is a path traversal vulnerability in Flowring Technology Corp's Agentflow 4.0. It affects the /WebAgenda/download/uploadFile.jsp API endpoint, allowing remote authenticated users to write files outside the intended upload directory by manipulating the path parameter. This vulnerability exists in versions before 2023/03/24. The CVSS 4.0 score is 7.1, indicating high severity. EPSS 0.3%Vulnerability Flowring Technology Corp #cwe-22	CVE Database V5	2026-09-29
Critical	9.3	EPSS 0.3%	CVE-2026-96431Agentflow 4.0 · Unrestricted upload of file with dangerous type Critical9.3EPSS 0.3%2026-09-29CVE Database V5CVE-2026-96431 Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file. EPSS 0.3%Vulnerability Flowring Technology Corp #cwe-434	CVE Database V5	2026-09-29
High	8.7	EPSS 0.2%	CVE-2026-96430Agentflow 4.0 · Exposed dangerous method or function High8.7EPSS 0.2%2026-09-29CVE Database V5CVE-2026-96430 Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter. EPSS 0.2%Vulnerability Flowring Technology Corp #cwe-749	CVE Database V5	2026-09-29
Critical	9.3	EPSS 0.3%	CVE-2026-96429Agentflow 4.0 · SQL injection Critical9.3EPSS 0.3%2026-09-29CVE Database V5CVE-2026-96429 SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter. EPSS 0.3%Vulnerability Flowring Technology Corp #cwe-89	CVE Database V5	2026-09-29
Critical	9.3	EPSS 0.3%	CVE-2026-96428Agentflow 4.0 · SQL injection Critical9.3EPSS 0.3%2026-09-29CVE Database V5CVE-2026-96428 SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter. EPSS 0.3%Vulnerability Flowring Technology Corp #cwe-89	CVE Database V5	2026-09-29

Showing 1–5 of 5 results