CVE-2026-96429: Flowring Technology Corp Agentflow 4.0

Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days.

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Affected products

• Flowring Technology Corp Agentflow 4.0

Published 2026-09-29. Last modified 2026-09-29.