| TVN ID | TVN-202609012 |
|---|---|
| CVE ID | CVE-2026-102455, CVE-2026-102456, CVE-2026-102457, CVE-2026-102458, CVE-2026-102459 |
| CVSS | 【CVE-2026-102455】 9.3 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 【CVE-2026-102456】 7.1 (High) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 6.5 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 【CVE-2026-102457】 7.1 (High) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N 6.5 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 【CVE-2026-102458】 9.3 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 【CVE-2026-102459】 5.1 (Medium) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N 6.1 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Affected Products | EasyFlow .NET V6.1.x and earlier EasyFlow .NET V6.6.19 and earlier EasyFlow .NET V8.1.5 and earlier |
| Description | 【CVE-2026-102455(Insecure Deserialization)】 Unauthenticated remote attackers can execute arbitrary codes on the server by sending maliciously crafted serialized content. 【CVE-2026-102456(SQL Injection)】 Authenticated remote attackers can inject arbitrary SQL commands to read database contents. 【CVE-2026-102457(Arbitrary File Read)】 Authenticated remote attackers can exploit this vulnerability to download arbitrary system files. 【CVE-2026-102458(Missing Authentication)】 Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API. 【CVE-2026-102459(Reflected Cross-site Scripting)】 Unauthenticated remote attackers can execute arbitrary JavaScript code in user's browser through phishing attacks. |
| Solution | 【CVE-2026-102455】 Update to the patch version released after April 16, 2026. 【CVE-2026-102456, CVE-2026-102459】 Update to the patch version released after June 26, 2026. 【CVE-2026-102457】 Update to the patch version released after April 20, 2026. 【CVE-2026-102458】 Update to the patch version released after April 17, 2026. |
| Credit | Heng-Chia Kuo |
| Public Date | 2026-09-30 |
:::