# CVE-2026-96429: Flowring Agentflow SQL injection in SMBAjaxConfigProcess API

Source: https://junglewise.ai/threats/cve-2026-96429-sql-injection-in-the-webagenda-smbajaxconfigprocess-do-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-96429 · Severity: info · Published 2026-09-29

Flowring Agentflow is an enterprise workflow management platform. Version 4.0 before 2025/08/08 contains a SQL injection vulnerability in an API endpoint that allows remote attackers to execute arbitrary database commands, potentially leading to unauthorized data access, modification, or deletion from the underlying database.

Technologies: [Flowring Agentflow](https://junglewise.ai/threats/technologies/agentflow). Vendors: [Flowring](https://junglewise.ai/threats/vendors/flowring).

## Quick answers

**Is CVE-2026-96429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96429 being exploited in the wild.

**How severe is CVE-2026-96429?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Flowring Agentflow 4.0 before 2025/08/08.

**Is there a fix for CVE-2026-96429?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96429 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96429?** Check whether you run Flowring Agentflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection vulnerability in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint via the id parameter allows remote attackers to inject arbitrary SQL commands without authentication. Successful exploitation enables read/write access to the database. A patch was released on or before 2025/08/08.

## Affected products

- Flowring Agentflow 4.0 before 2025/08/08

## Timeline

- 2026-09-29: advisory

## References

- [https://zuso.ai/cve-advisory/advisory](https://zuso.ai/cve-advisory/advisory)

## Related threats

- [Flowring Agentflow path traversal in file upload API](https://junglewise.ai/threats/cve-2026-96440-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [Flowring Agentflow arbitrary file upload in uploadFile.jsp API](https://junglewise.ai/threats/cve-2026-96431-unrestricted-upload-of-file-with-dangerous-type-in-the-webagenda)
- [Flowring Agentflow SQL injection in SQLWin.do API endpoint](https://junglewise.ai/threats/cve-2026-96430-exposed-dangerous-method-or-function-in-the-webagenda-sqlwin-do)
- [Flowring Agentflow SQL injection in SMBAjaxAutoComplete](https://junglewise.ai/threats/cve-2026-96428-sql-injection-in-the-webagenda-smbajaxautocomplete-do-api)