CVE-2026-5964

EasyFlow .NET, a product developed by Digiwin, contains a critical SQL Injection vulnerability (CVE-2026-5964) that permits unauthenticated remote attackers to execute arbitrary SQL commands against the application's database. The flaw enables attackers to read, modify, and delete sensitive database contents without requiring valid credentials or user interaction. The vulnerability carries a CVSS v3.1 score of 9.8 (Critical), reflecting its severe nature across all impact categories. The attack is network-based, requires no special access privileges, and involves low attack complexity, meaning it can be exploited trivially by remote threat actors with minimal prerequisites. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the KEV Catalog or active threat intelligence lists. The EPSS score of 0.0008 indicates this vulnerability is ranked lower than most CVEs in terms of predicted exploitation likelihood, though organizations should still prioritize remediation given its critical severity rating and the ease with which it can be exploited.