CVE-2025-13164
Digiwin｜EasyFlow GP - Insufficiently Protected Credentials
- State
- Published
- Severity
- 6.9 Medium
- Published
- Nov 17, 2025
- Updated
- Nov 17, 2025
- Reserved
- Nov 14, 2025
Description
EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | twcert |
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | twcert |
Weaknesses
- CWE-522 Insufficiently Protected Credentials
Affected Products
| Product | Versions |
|---|---|
EasyFlow GPDigiwin |
|
References
- https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.htmlthird-party-advisory
- https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.htmlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.