EasyFlow .NET, a product of Digiwin, has a SQL Injection flaw that lets unauthenticated remote attackers execute arbitrary SQL commands. The vulnerability can be used to read, modify, or delete database contents, directly compromising the confidentiality, integrity, and potentially the availability of stored data.

Digiwin EasyFlow .NET versions prior to 8.1.5 are affected, including any build that has not applied the 2026/01/20 patch. Vendors and administrators should treat all non‑up‑to‑date installations as vulnerable.

The CVSS score of 9.3 indicates a high severity. EPSS is not available, but the lack of a KEV listing does not negate the risk; the attack can be performed without authentication over the network when the application is exposed. Exploitation requires only the ability to send HTTP requests to the vulnerable endpoint and does not rely on specialized configuration or privileged access.