On October 20, TWCERT/CC published TVN-202610007: Asia Xuan Information's BA-Workflow contains three SQL injection vulnerabilities, each with a CVSS v4.0 score of 8.7, allowing remote attackers with regular user privileges to read, modify, and delete database contents [1]. CVE-2026-113405 and CVE-2026-113406 affect versions prior to v3.6, while CVE-2026-113407 affects versions prior to v3.6.2.7; update to v3.6.2.7 or later [1].
BA-Workflow Form Platform Contains Three SQL Injection Vulnerabilities (CVE-2026-113405 to CVE-2026-113407)
1 min read
- Disclosed
- Oct 20, 2026
- Published
- Nov 7, 2026
- Last updated
- Nov 6, 2026
- CVSS basis
- [1]
- 0.5%, higher than 44% of CVEs
- Exploitation and patch status
- Patch available
- Technology
- Vulnerability status
On this page
30-second summary
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| 亞璿資訊 BA-Workflow 工作流程表單平台 | < v3.6.2.7[1] | v3.6.2.7 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
- TWCERT/CC publishes TVN vulnerability advisory; patched version released[1]
Technical details
Vulnerability Details
All three vulnerabilities are SQL injection flaws reported by researchers at CHT Security; they are patched in version v3.6.2.7 [1].
Remediation
Vendor guidance
- 1Update to v3.6.2.7 patch[1]
References
Official / primary1
- [1]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.