CVE-2026-113406
Received Received - Intake

SQL Injection in BA-Workflow

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TWCERT/CC

Description
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113406
EUVD
EUVD-2026-104825

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
YS-infoware BA-Workflow 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection in BA-Workflow developed by YS-infoware. Authenticated remote attackers can inject malicious SQL statements to read, modify, or delete database contents.

Detection Guidance

Detecting SQL injection vulnerabilities like CVE-2026-113406 typically involves monitoring database logs for unusual queries, using web application firewalls to detect malicious input patterns, and performing penetration testing with tools like SQLmap to identify injection points.

Impact Analysis

An attacker could access sensitive data, alter or delete records, or gain unauthorized control over the database. This could lead to data breaches, loss of data integrity, or system compromise.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or loss. GDPR requires protection of personal data, while HIPAA mandates safeguards for health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update BA-Workflow to the latest patched version. Apply input validation and parameterized queries to prevent SQL injection. Restrict database user permissions to limit potential damage. Monitor database activity for suspicious queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart