Skip to content
OpenAdvisories

Vendor

risesoft-y9

7 known vulnerabilities.

Products

Digital-Infrastructure 5 WorkFlow-Engine 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-111651

    Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController

    Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to ex…

    risesoft-y9 Digital-Infrastructure
  • Medium 6.5
    CVE-2026-110118

    WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints

    WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the com…

    risesoft-y9 WorkFlow-Engine
  • Medium 5.4
    CVE-2025-7108

    risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversal

    A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the function deleteFile of the file /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-…

    risesoft-y9 Digital-Infrastructure