CVE-2022-39036: critical vulnerability in FLOWRING Agentflow BPM
FLOWRING Agentflow BPM - Arbitrary File Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.5%
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
FLOWRING · Agentflow BPMRelated CVEs — FLOWRING Agentflow BPM
In the same product, most dangerous first.