# CVE-2026-102459: Digiwin EasyFlow .NET reflected cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-102459-easyflow-net-developed-by-digiwin-has-a-reflected-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102459 · Severity: medium · CVSS 6.1 · Published 2026-09-30

EasyFlow .NET is a workflow and business process management platform used by enterprises. An unauthenticated attacker can inject arbitrary JavaScript code that executes in users' browsers through phishing attacks, potentially stealing session credentials, performing unauthorized actions, or redirecting users to malicious sites.

Technologies: [Digiwin Easyflow .Net](https://junglewise.ai/threats/technologies/easyflow-net). Vendors: [Digiwin](https://junglewise.ai/threats/vendors/digiwin).

## Quick answers

**Is CVE-2026-102459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102459 being exploited in the wild.

**How severe is CVE-2026-102459?** Medium severity, with a CVSS score of 6.1, published 30 September 2026.

**Which products and versions are affected?** Digiwin Easyflow .Net V6.1.x and earlier, V6.6.19 and earlier, V8.1.5 and earlier.

**Is there a fix for CVE-2026-102459?** A patch was published on 2026-06-26: Patch released after June 26, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102459 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102459?** Check whether you run Digiwin Easyflow .Net at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting vulnerability exists in EasyFlow .NET that allows unauthenticated remote attackers to inject malicious JavaScript through URL parameters or form inputs. The vulnerability requires user interaction (clicking a phishing link) but no authentication. Successful exploitation enables attackers to hijack user sessions, exfiltrate sensitive data, or perform actions on behalf of the victim.

## Affected products

- Digiwin EasyFlow .NET V6.1.x and earlier, V6.6.19 and earlier, V8.1.5 and earlier

## Timeline

- 2026-09-30: disclosed
- 2026-06-26: patched: Patch released after June 26, 2026

## References

- [https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html](https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html)
- [https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html](https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html)

## Related threats

- [Digiwin EasyFlow .NET missing authentication in API](https://junglewise.ai/threats/cve-2026-102458-easyflow-net-developed-by-digiwin-has-a-missing-authentication)
- [Digiwin EasyFlow .NET arbitrary file read](https://junglewise.ai/threats/cve-2026-102457-easyflow-net-developed-by-digiwin-has-an-arbitrary-file-read)
- [Digiwin EasyFlow .NET SQL injection](https://junglewise.ai/threats/cve-2026-102456-easyflow-net-developed-by-digiwin-has-an-sql-injection)
- [Digiwin EasyFlow .NET insecure deserialization](https://junglewise.ai/threats/cve-2026-102455-easyflow-net-developed-by-digiwin-has-a-insecure-deserialization)
- [Digiwin EasyFlow .NET arbitrary file upload vulnerability](https://junglewise.ai/threats/cve-2026-102454-easyflow-net-developed-by-digiwin-has-an-arbitrary-file-upload)