Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.java of the component REST Authenticate Endpoint. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Authentication endpoints should never trust user input. We found one that did. This resulted in a SQL Injection. Here is the breakdown of CVE-2026-1050. https://t.co/rNPHEDLGQU
Post summary
A tweet points out a SQL injection flaw in an authentication endpoint (CVE‑2026‑1050) but provides no evidence of exploitation, PoC, or patch information.
Target: Digital-Infrastructure (<= 9.6.7) Vuln: SQL Injection (CVE-2026-1050) Cause: Unsanitized String Concatenation. The vulnerability affects multiple auth endpoints, including /authenticate3 and /authenticate5.
Post summary
The post discloses a SQL Injection vulnerability (CVE‑2026‑1050) in Digital‑Infrastructure ≤9.6.7, affecting multiple authentication endpoints due to unsanitized string concatenation.
The vulnerability (CVE-2026-1050) resides in Y9PlatformUtil. The application constructed SQL queries by concatenating strings ("..." + loginName + "...") rather than using bind variables.
Post summary
The text discloses that CVE-2026-1050 is a SQL injection vulnerability in Y9PlatformUtil caused by concatenating the loginName into SQL queries.