CVE-2026-102616High· 7.3▾ MidnightPoC availableA vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The sink is injectable on two independent positions, not just one. The vendor was contacted early about this disclosure but did not respond in any way.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102491High· 7.3A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7
CVE-2026-101105Medium· 6.3A vulnerability was determined in code-projects Matrimonial System 1.0
CVE-2025-14666High· 7.3A weakness has been identified in itsourcecode COVID Tracking System 1.0
CVE-2025-14667High· 7.3A security vulnerability has been detected in itsourcecode COVID Tracking System 1.0
CVE-2025-14668High· 7.3A vulnerability was detected in campcodes Advanced Online Examination System 1.0
CVE-2025-14664High· 7.3A vulnerability was identified in Campcodes Supplier Management System 1.0