CVE-2025-13163

MEDIUM

Digiwin EasyFlow GP 5.8.8.3-5.8.11.1.0810112 and 8.1.0-8.1.1.2 - Insufficiently Protected Database Credentials

Title source: llm
STIX 2.1

Description

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html

Scores

CVSS v3 4.9
EPSS 0.0029
EPSS Percentile 20.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-522
Status published
Products (2)
Digiwin/EasyFlow GP 5.8.8.3 - 5.8.11.1.0810112
Digiwin/EasyFlow GP 8.1.* - 8.1.1.2
Published Nov 17, 2025
Tracked Since Feb 18, 2026