CVE-2026-5963

EasyFlow .NET, developed by Digiwin, contains a critical SQL injection vulnerability (CVE-2026-5963) that permits unauthenticated remote attackers to inject arbitrary SQL commands into the application. The flaw enables threat actors to read, modify, and delete database contents without authentication, affecting the confidentiality, integrity, and availability of systems running this software. The vulnerability carries a CVSS score of 9.8 (Critical) with a network-based attack vector requiring low complexity and no user interaction, indicating high exploitability. The attack surface is extensive given that no authentication is required and the vulnerability can be triggered over the network without prerequisites. Current exploitation status appears limited, with the CVE not appearing on the CISA Known Exploited Vulnerabilities list and showing minimal community attention on the Hot List (Inactive status). The EPSS score of 0.0008 suggests low predicted exploitation probability in the next 30 days, though organizations should prioritize patching given the critical severity rating and potential for rapid weaponization.