← voltar
CVE-2026-1050

risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injection

CVSS 6.9 MEDIUMEPSS 0.4%CWE-74CWE-89
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 6.9EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
17 jan 2026Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.java of the component REST Authenticate Endpoint. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
risesoft-y9 · Digital-Infrastructure
Referências
https://github.com/risesoft-y9/Digital-Infrastructure/https://github.com/risesoft-y9/Digital-Infrastructure/issues/2https://github.com/risesoft-y9/Digital-Infrastructure/issues/2#issue-3777863959https://vuldb.com/?ctiid.341603https://vuldb.com/?id.341603https://vuldb.com/?submit.731010