News & Sicurezza

Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA Databases SAP has released its security update for February 2026, issuing patches for 26 new vulnerabilities across its enterprise ecosystem. Leading the pack is a critical code injection flaw in SAP CRM and SA ... Read more Published Date: Feb 10, 2026 (17 hours, 16 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-23689 CVE-2026-23687 CVE-2026-0509 CVE-2026-0508 CVE-2026-0490 CVE-2026-0488 CVE-2026-0485 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-12383 CVE-2025-0070 CVE-2025-0066 CVE-2024-47578

CVE ID : CVE-2026-1722 Published : Feb. 10, 2026, 8:15 a.m. | 6 hours, 6 minutes ago Description : The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.

CVE ID : CVE-2026-2099 Published : Feb. 10, 2026, 7:16 a.m. | 7 hours, 5 minutes ago Description : AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2097 Published : Feb. 10, 2026, 7:16 a.m. | 5 hours, 5 minutes ago Description : Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2098 Published : Feb. 10, 2026, 7:16 a.m. | 5 hours, 5 minutes ago Description : AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2096 Published : Feb. 10, 2026, 7:16 a.m. | 3 hours, 5 minutes ago Description : Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

CVE ID : CVE-2026-2094 Published : Feb. 10, 2026, 7:16 a.m. | 1 hour, 5 minutes ago Description : Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...