CVE-2025-13164CWE-522

CVE-2025-13164

Medium · published November 17, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credentials of AD and system mail from the system frontend.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2025-11-17T13:16Z
References (2)
https://www.twcert.org.tw/en/cp-139-10504-23f4c-2.html · [email protected]https://www.twcert.org.tw/tw/cp-132-10503-a66fe-1.html · [email protected]
EPSS history
Timeline
  • 17 NOV 06:23Z
    Digiwin｜EasyFlow GP - Insufficiently Protected Credentials
    cvelistv5