Threat Database

Threat Entry Updated 2026-10-30

Zoho Flow - Security Vulnerability (CVE-2026-62131)

Unauthenticated PHP Object Injection in Zoho Flow

PLUGIN Zoho Flow

CVE-2026-62131

CRITICAL CVSS 9.8 2026-10-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Zoho Flow - Cross-Site Request Forgery (CSRF) (CVE-2025-59568)

Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through

PLUGIN Zoho Flow

CVE-2025-59568

MEDIUM CVSS 4.3 2025-09-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Zoho Flow - Cross-Site Request Forgery (CSRF) (CVE-2025-8479)

The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Zoho Flow

CVE-2025-8479

MEDIUM CVSS 4.3 2025-09-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Zoho Flow - Broken Access Control (CVE-2025-31408)

Missing Authorization vulnerability in Zoho Flow Zoho Flow zoho-flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through

PLUGIN Zoho Flow

CVE-2025-31408

MEDIUM CVSS 4.3 2025-04-01

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Zoho Flow - SQL Injection (CVE-2024-47334)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Flow Zoho Flow zoho-flow allows SQL Injection.This issue affects Zoho Flow: from n/a through

PLUGIN Zoho Flow

CVE-2024-47334

HIGH CVSS 7.6 2024-10-09

Risk Score

Open Full Technical Breakdown