CVE-2026-102616
highA vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10.
A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The sink is injectable on two independent positions, not just one. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/fangtang7/CVE/blob/main/WorkFlow-Engine/sql.md cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-102616 cna@vuldb.com
- https://vuldb.com/submit/942286 cna@vuldb.com
- https://vuldb.com/vuln/411406 cna@vuldb.com
- https://vuldb.com/vuln/411406/cti cna@vuldb.com