BA-Workflow, developed by YS‑infoware, contains a SQL Injection flaw that allows authenticated remote attackers to inject arbitrary SQL statements. By exploiting this vulnerability, attackers can read, modify, or delete database contents, compromising confidentiality, integrity, and availability of the application’s data.

The affected product is YS‑infoware BA‑Workflow. No specific version ranges are provided in the CNA data, but the vendor’s solution indicates that updates to v3.6.2.7 or later address the flaw.

The CVSS score of 8.7 classifies the vulnerability as high severity. The EPSS score of less than 1% suggests a low yet nonzero likelihood of exploitation at the time of analysis; the CVE is not listed in the CISA KEV catalog. Exploitation requires remote authenticated access to the application, implying that compromised or privileged credentials are needed to execute the injection attack.