CVE-2026-113405

{
  "etk_id": "ETK-2026-2137",
  "cve_id": "CVE-2026-113405",
  "display_id": "CVE-2026-113405",
  "ghsa_id": "GHSA-84wj-3f7g-6wv4",
  "euvd_id": "EUVD-2026-104824",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authenticated SQL injection in BA-Workflow",
  "summary": "YS-infoware BA-Workflow is affected by an SQL injection vulnerability. An authenticated remote attacker may read, alter, or remove database data by exploiting the flaw. Exploitation requires valid authentication to the affected application.",
  "mitigation": "Upgrade BA-Workflow to v3.6. Restrict access to authenticated BA-Workflow interfaces until the upgrade is complete.",
  "vendor": "YS-infoware",
  "product": "BA-Workflow",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < v3.6"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "v3.6"
      ],
      "package_name": "BA-Workflow",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0037,
  "epss_percentile": 0.2975,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 17.644241133333335,
  "t0_at": "2026-10-20T07:17:45.541000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T08:12:08.820200+00:00",
      "days": 0.037769435185185184,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T07:17:45.541000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-20T07:17:45.541000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T07:17:45.541000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113405"
    }
  }
}