CVE-2025-11949: Digiwin Easyflow .net

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.

Affected products

• Digiwin Easyflow .net: up to and including 6.6.19
• Digiwin Easyflow Ainet: up to and including 8.1.1

Published 2025-10-21. Last modified 2026-06-17.