CVE-2025-13163CWE-522

CVE-2025-13163

Medium · published November 17, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database account credentials from the system frontend.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2025-11-17T13:16Z
References (2)
https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html · [email protected]https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html · [email protected]
EPSS history
Timeline
  • 17 NOV 06:17Z
    Digiwin｜EasyFlow GP - Insufficiently Protected Credentials
    cvelistv5