Threats affecting pkg:maven/risesoft-y9/WorkFlow-Engine

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.9	EPSS 0.3%	CVE-2026-102616risesoft-y9 WorkFlow-Engine · SQL Injection Medium6.9EPSS 0.3%2026-09-29CVE Database V5CVE-2026-102616 CVE-2026-102616 is a medium severity SQL injection vulnerability in risesoft-y9 WorkFlow-Engine versions 9.6.0 through 9.6.10. The flaw exists in the getByIdAndYear function of the CustomHistoricProcessServiceImpl.java file within the OAuth2 Resource Filter component. It allows remote attackers to manipulate the year or processInstanceId arguments to perform SQL injection at two independent injection points. The vendor has not responded to disclosure attempts, and public exploit code is available. EPSS 0.3%Vulnerability	CVE Database V5	2026-09-29

Page 1 of 1