CVE-2026-96428

The Flowring Agentflow 4.0 API is vulnerable to SQL injection through the /WebAgenda/SMBAjaxAutoComplete.do endpoint, allowing remote attackers to execute arbitrary SQL commands by manipulating the 'words' parameter. This critical vulnerability, with a CVSS score of 9.3, poses a significant risk of data exposure and unauthorized access to the database. Organizations using affected versions should prioritize immediate remediation to mitigate potential exploitation.