GitHub Advisoryadvisory · Maven

GHSA-vhcx-7rpg-hp39 risesoft-y9 Digital-Infrastructure has a SQL injection vulnerability

MEDIUM Published 2026-01-17 Modified 2026-01-20 Official page ↗
Aliases
CVE-2026-1050
Ecosystem
Maven
Packages
net.risesoft:risenet-y9boot-support-platform-service
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-74
Reviewed
2026-01-20

Affected packages

• Maven net.risesoft:risenet-y9boot-support-platform-service: <= 9.7.0-M5 (no fix yet)

Description

A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.java of the component REST Authenticate Endpoint. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Related

Alias · CVE (1)

  • CVE-2026-1050 A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References