Which versions of Prog Management System are affected by CVE-2026-14808?

Prog Management System by PROG MIS contains a critical vulnerability (CVE-2026-14808, CVSS 9.3) that exposes database credentials to any unauthenticated attacker with network access.

How to fix or mitigate CVE-2026-14808?

24 hours: Restrict network access to Prog Management System via firewall rules to known legitimate IP ranges only; immediately rotate all database account credentials assuming compromise. 7 days: Deploy network-based intrusion detection rules to block access to the vulnerable credential disclosure endpoint; implement Web Application Firewall policies to filter requests to the affected page; review database access logs for any unauthorized connection attempts using old credentials. 30 days: Initiate evaluation and procurement of a replacement management platform or secured alternative from PROG MIS; establish timeline for complete migration to reduce ongoing risk exposure.

Prog Management System CVE-2026-14808

Q: What is the CVSS score of CVE-2026-14808?

CVE-2026-14808 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41817 CRITICAL

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-06 twcert

GHSA-g27h-3x9v-xxqq

Information Disclosure Prog Management System Prog Mis

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated remote read of a page (AV:N/AC:L/PR:N/UI:N); direct impact is credential disclosure so C:H, with I:N/A:N since the flaw itself only discloses data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 07:50 vuln.today

DescriptionCVE.org

Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the database account and password.

AnalysisAI

Sensitive information exposure in Prog Management System (developed by PROG MIS) allows unauthenticated remote attackers to access a specific page that discloses the database account name and password. With valid database credentials leaked, an attacker gains a direct path to full compromise of the backing database and any data it holds. There is no public exploit identified at time of analysis, but the flaw is trivially exploitable given the CVSS 4.0 score of 9.3 (critical) and reported unauthenticated network vector.

Technical ContextAI

The affected product is Prog Management System, a management information system product identified by CPE cpe:2.3:a:prog_mis:prog_management_system. The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere): the application serves a page that reveals internal configuration data - specifically database connection credentials - to clients that should never see it. This typically stems from a debug, status, configuration, or connection-test endpoint that echoes back the DB account and password in cleartext (or exposes a config file/variable) without any authentication gate, allowing anyone who can reach the page over the network to harvest the credentials.

RemediationAI

No specific vendor-released fix version is enumerated in the available data, so the primary step is to consult the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11026-3df18-2.html and https://www.twcert.org.tw/tw/cp-132-11025-fa1d9-1.html) and contact PROG MIS to obtain and apply the patched release. As immediate compensating controls until patched: restrict network access to the Prog Management System so the exposed page is unreachable from untrusted networks (place it behind a VPN or IP allowlist), and use a reverse proxy or WAF rule to block external requests to the specific credential-disclosing page/endpoint - the trade-off is potential disruption to legitimate remote users if the blocked path overlaps normal functionality. Critically, because valid database credentials may already be exposed, rotate the disclosed database account password immediately and audit database access logs for unauthorized connections; assume the leaked credentials are compromised. Note that path-blocking is fragile if the same data is reachable via alternate routes, so network-level restriction is the stronger interim control.