汇总 digiwin 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
已披露问题常与 SQL 注入、路径处理缺陷与XXE 相关，可能在 软件部署与生产负载 场景中带来 数据泄露与文件覆盖 等暴露风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2026-5964 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. | [email protected] | 9.3 | 0.37% | 2026-04-20 | 2026-06-17 |
| CVE-2026-5963 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. | [email protected] | 9.3 | 0.37% | 2026-04-20 | 2026-06-17 |
| CVE-2024-7323 | Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server . | [email protected] | 6.5 | 0.60% | 2024-08-02 | 2026-06-17 |
| CVE-2022-32458 | Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files. | [email protected] | 7.5 | 0.88% | 2022-07-19 | 2026-06-17 |
| CVE-2022-32457 | Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response. | [email protected] | 5.3 | 0.65% | 2022-07-19 | 2026-06-17 |
| CVE-2022-32456 | Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service. | [email protected] | 9.8 | 1.30% | 2022-07-19 | 2026-06-17 |