CVE-2026-14804
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
HUMANIST Digital Human Resources by Bilin Software contains a hard-coded cryptographic key vulnerability, allowing read of sensitive constants within an executable.
Risk Assessment
An attacker can extract the cryptographic key from the executable, potentially leading to data confidentiality breaches or impersonation.
Recommendation
Update HUMANIST Digital Human Resources to version 26.1 or later, which includes a fix removing the hard-coded key.
Other vulnerabilities in HUMANIST Digital Human Resources
See all- CVE-2026-15721Critical
In HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc., there is a vulnerability involving cleartext storage of sensitive information that allows SQL Injection. The issue affects versions from 26.0 before 26.1.
- CVE-2026-14175Critical
Unrestricted upload of dangerous file types in HUMANIST Digital Human Resources allows uploading a web shell to the server. Affects versions from 26.0 before 26.1.
- CVE-2026-14838High
HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc. has a Session Hijacking vulnerability due to use of GET request method with sensitive query strings. Affects versions from 26.0 before 26.1.
- CVE-2026-14465Medium
A vulnerability in HUMANIST Digital Human Resources by Bilin Software allows insufficient session expiration, enabling session ID reuse (Session Replay). The issue affects versions from 26.0 before 26.1.
- CVE-2026-14219Medium
HUMANIST Digital Human Resources from 26.0 before 26.1 has an open redirect vulnerability that allows phishing.
- CVE-2026-14202Medium
HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc. has an observable response discrepancy vulnerability that allows Account Footprinting. The issue affects versions from 26.0 before 26.1.
- CVE-2026-14194Medium
A Path Traversal vulnerability was found in HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc., allowing access to files outside the restricted directory. The issue affects versions from 26.0 before 26.1.
- CVE-2026-14192Medium
Improper neutralization of input during web page generation (cross-site scripting) vulnerability in HUMANIST Digital Human Resources allows Stored XSS. Affects versions from 26.0 before 26.1.
Original NVD description (English source)
Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.