MajorCritical vulnerability
CVE-2026-96430 (CVSS 8.7)
NVD · officialPublished Sep 29, 2026Risk 37/100
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.
Technical details
CVSS
8.7
AV:NetworkAC:LowPR:LowUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source