A vulnerability exists in the CustomHistoricProcessServiceImpl.java component of the OAuth2 Resource Filter within risesoft-y9 WorkFlow‑Engine. By manipulating the arguments year and processInstanceId sent to the getByIdAndYear method, an attacker can inject arbitrary SQL into two independent positions in the query. This injection can lead to the disclosure of sensitive data, alteration or deletion of database records, and potentially give an attacker broader control over the application’s database. The weakness is categorized as CWE‑74 and CWE‑89.

The flaw affects all releases of risesoft‑y9 WorkFlow‑Engine up to and including version 9.6.10. The vulnerability is present in the OAuth2 Resource Filter component, specifically the CustomHistoricProcessServiceImpl.java file, where the getByIdAndYear function does not properly sanitize its input parameters.

The CVSS score of 6.9 indicates a moderate to high risk level. The EPSS score is not available, but public exploitation scripts exist and the vendor has not responded to the disclosure, increasing the likelihood of real‑world attacks. The attack vector is remote, as the injection can occur over the network through exposed endpoints. The vulnerability is not listed in CISA’s KEV catalog, but its public availability and lack of mitigation elevate the threat level for impacted installations.