Description
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
Published: 2026-10-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Breach and Modification
Action: Update
AI Analysis

Impact

BA-Workflow, a workflow engine from YS-infoware, contains a SQL Injection flaw. The vulnerability allows an authenticated remote user to craft arbitrary SQL statements, which the application then executes against its underlying database. This can result in unauthorized disclosure, alteration, or deletion of data stored in the database, leading to serious confidentiality and integrity violations.

Affected Systems

The affected product is YS-infoware BA‑Workflow. No specific version range is listed as affected, but a fix is available in version v3.6.2.7 and later.

Risk and Exploitability

The CVSS base score of 8.7 indicates a high risk classification, while the EPSS probability score of <1% suggests low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, and it requires authenticated remote access to exploit. Attackers with valid credentials can therefore leverage the flaw to control database contents.

Generated by OpenCVE AI on October 20, 2026 at 16:26 UTC.

Remediation

Vendor Solution

Update to version v3.6.2.7 or later.

OpenCVE Recommended Actions

  • Apply the official patch to move to version v3.6.2.7 or later.
  • Ensure that only administrators with a legitimate business need can access database interfaces and that all other users run under restricted accounts.
  • Deploy a Web Application Firewall or enforce strict input validation to detect and reject malicious SQL payloads in user input.

Generated by OpenCVE AI on October 20, 2026 at 16:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Ys-infoware
Ys-infoware ba-workflow
Vendors & Products Ys-infoware
Ys-infoware ba-workflow

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
Title YS-infoware｜BA-Workflow - SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ys-infoware Ba-workflow
cve-icon MITRE

Status: PUBLISHED

Assigner: twcert

Published:

Updated: 2026-10-20T18:08:01.040Z

Reserved: 2026-10-20T06:01:50.901Z

Link: CVE-2026-113407

cve-icon Vulnrichment

Updated: 2026-10-20T18:07:43.286Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T08:16:43.130

Modified: 2026-10-20T19:28:52.970

Link: CVE-2026-113407

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T20:31:50Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')