TVN ID	TVN-202606006
CVE ID	CVE-2026-12580, CVE-2026-12581
CVSS	【CVE-2026-12580】 5.4 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N 【CVE-2026-12581】 7.5 (High) CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products	EasyFlow .NET version 8.1.4 and earlier
Description	【CVE-2026-12580(Stored Cross-Site Scripting)】 Authenticated remote attackers can inject persistent JavaScript code executed in users' browsers upon page load. 【CVE-2026-12581(Session Fixation)】 If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.
Solution	Update to version 8.1.5 or later
Credit	P.K. Hsu
Public Date	2026-06-22