HUMANIST Digital HR CVE-2026-15721

Exploitation requires network reachability to the HUMANIST Digital Human Resources web application running an affected version (26.0 through before 26.1). Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication and no user interaction are required against the exposed application. The primary limiting factor is exposure: an instance restricted to internal networks or behind VPN/WAF substantially reduces reachability. The sensitive-data-disclosure severity further depends on the cleartext storage of HR data, so the confidentiality impact is realized specifically because affected data is not encrypted at rest.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, remote, unauthenticated attack with maximal impact - consistent with classic exploitable SQL injection. This is a genuine high-priority profile on paper. However, key corroborating signals are absent: no EPSS exploitation-probability score, no CISA KEV listing, and no POC reference were provided, so real-world exploitation is unproven. There is also an internal inconsistency in the source data worth flagging: the CWE is CWE-312 (cleartext storage) while the description and tags emphasize SQL Injection - these are related but distinct weaknesses, so treat the root cause as SQLi enabling access to cleartext-stored data and verify the exact mechanism with the vendor/TR-CERT advisory. Given a Turkey-focused HR product with an unclear global footprint, the practical risk is likely targeted rather than widespread despite the 9.8 score.

A remote, unauthenticated attacker submits a crafted parameter to a vulnerable HUMANIST input field or endpoint, injecting SQL that is executed against the backend database. Because sensitive HR records are stored in cleartext, the attacker directly exfiltrates personal, credential, or payroll data and can modify or delete records, impacting confidentiality, integrity, and availability. No POC has been identified, but the low-complexity unauthenticated vector makes exploitation straightforward once the vulnerable parameter is located.