Advisories · Technology

ITFlow.

Every CVE that names ITFlow among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-97735 CVE record

CVSS 8.0 High

Cross-site scripting in ITFlow
- ITFlow
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2026-54597 CVE record

CVSS 8.3 High

ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
- itflow
- SQL injection
Not analysed yet 17 Sept 2026
CVE-2026-54596 CVE record

CVSS 8.1 High

ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
- itflow
- SQL injection
Not analysed yet 17 Sept 2026
CVE-2026-47755 CVE record

CVSS 6.5 Medium

ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal
- itflow
- Broken access control
Not analysed yet 23 Jul 2026