CVE-2026-96430 HIGH

CVE-2026-96430: Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

Vendor Flowring Technology Corp

Product Agentflow 4.0

Weakness CWE-749

Published September 29, 2026

Last update September 29, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

Key dates

02Disclosure timeline

September 29, 2026 CVE published

September 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-96430 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/749.html AskarLabs — CWE-749 write-up Exposed Dangerous Method or Function

Related vulnerabilities

CVE-2026-96430: Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

01Description

02Disclosure timeline

03References

04Related CVE