Vulnerabilities

TI-2026-75437 CVE-2026-111651 · GHSA-68m3-8x64-fhgg

Risesoft Digital-Infrastructure exposes other tenants' personnel data

LOW 31

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-10-16 No fix listed CWE-639

TI-2026-72002 CVE-2026-110118 · GHSA-j9qx-hx2v-8q9m

Missing authorization in WorkFlow-Engine task buttonOperation endpoints

LOW 31

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00277 Published 2026-10-13 No fix listed CWE-639

TI-2026-72000 CVE-2026-110116 · GHSA-384w-qhxp-j99v

Path traversal in Risesoft-y9 Digital-Infrastructure lets attackers write files

MEDIUM 45

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00592 Published 2026-10-13 No fix listed CWE-22

TI-2026-71999 CVE-2026-110115 · GHSA-qqmw-cvh2-5395

Path traversal in Risesoft Digital-Infrastructure file retrieval

MEDIUM 44

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00433 Published 2026-10-13 No fix listed CWE-22

TI-2026-65446 CVE-2026-102616 · GHSA-4pwj-27hr-h3gw

risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

HIGH 70

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00254 Published 2026-09-29 No fix listed CWE-74

TI-2026-00785 CVE-2026-1050 · GHSA-vhcx-7rpg-hp39

risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection

HIGH 70

A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00396 Published 2026-01-17 No fix listed CWE-74

TI-2025-06470 CVE-2025-7108 · GHSA-8v94-68h6-68c2

risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal

MEDIUM 57

A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00456 Published 2025-07-07 No fix listed CWE-22