CVE-2026-113406

CVSS 8.8 (high) · published 2026-10-20

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

Weakness: CWE-89

Source: NVD CVE-2026-113406

References

• https://www.chtsecurity.com/news/68333401-bb20-4563-99ed-6299c3b390e9
• https://www.chtsecurity.com/news/e0c80f83-8d79-4d2f-bb0b-d67b6b7315e8
• https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html
• https://www.twcert.org.tw/tw/cp-132-11298-d9dd5-1.html

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.