Flowring Technology Corp Agentflow 4.0 vulnerabilities

Latest Flowring Technology Corp Agentflow 4.0 CVEs

Newest publication first

1. CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

   Published 2026-09-29

   High·CVSS 7.1 EPSS 0.29%

   Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended up...

2. CVE-2026-96431 Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

   Published 2026-09-29

   Critical·CVSS 9.3 EPSS 0.30%

   Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.

3. CVE-2026-96430 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

   Published 2026-09-29

   High·CVSS 8.7 EPSS 0.23%

   Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

4. CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

   Published 2026-09-29

   Critical·CVSS 9.3 EPSS 0.28%

   SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.

5. CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection

   Published 2026-09-29

   Critical·CVSS 9.3 EPSS 0.34%

   SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.