Which versions of Prog Management System are affected by EUVD-2026-41822?

An unauthenticated SQL injection vulnerability in PROG MIS's Prog Management System (CVE-2026-14809, CVSS 8.7) allows remote attackers to access and extract sensitive database contents without…

How to fix or mitigate EUVD-2026-41822?

Within 24 hours: Inventory all systems running PROG MIS's Prog Management System and restrict network exposure of affected instances to essential users only. Within 7 days: Contact PROG MIS vendor directly to confirm patch timeline and request security advisory; implement interim SQL injection defenses (see compensating controls). Within 30 days: Deploy compensating controls or upgrade to patched version once released; conduct database access audit and logging review to identify potential prior unauthorized access.

Prog Management System EUVD-2026-41822

Q: What is the CVSS score of EUVD-2026-41822?

EUVD-2026-41822 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-14809 HIGH

SQL Injection (CWE-89)

2026-07-06 twcert

GHSA-4r22-42g6-89f9

SQLi Prog Management System Prog Mis

8.7

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated, low-complexity, network-reachable SQL injection with no user interaction (PR:N/UI:N/AC:L), impacting only confidentiality via database read (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 09:15 vuln.today

DescriptionCVE.org

Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

AnalysisAI

SQL injection in PROG MIS's Prog Management System allows unauthenticated remote attackers to inject arbitrary SQL commands and read arbitrary database contents. The flaw carries a CVSS 4.0 base score of 8.7 (High) and requires no authentication, privileges, or user interaction, but its impact is limited to confidentiality (data disclosure) rather than data modification or service disruption. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed via Taiwan's TWCERT.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) affecting the web-facing Prog Management System application from vendor PROG MIS (CPE cpe:2.3:a:prog_mis:prog_management_system). The root cause is that attacker-controlled input is concatenated into SQL queries without proper parameterization or input sanitization, allowing an attacker to break out of the intended query context and append or alter SQL clauses. Because the CVSS impact is scoped solely to confidentiality (VC:H, VI:N, VA:N), the demonstrated capability is reading database records - for example via UNION-based or boolean/time-based blind extraction - rather than writing or destroying data. Prog Management System appears to be a Taiwan-market management/administrative platform; precise module and parameter details are not published in the available intelligence.

RemediationAI

No vendor-released patch version is identified in the available data, so consult the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11026-3df18-2.html and https://www.twcert.org.tw/tw/cp-132-11025-fa1d9-1.html) and contact PROG MIS directly for a fixed release, then upgrade to the patched version once published. As compensating controls until a patch is applied, place the application behind a web application firewall with SQL-injection signatures tuned to the vulnerable endpoints (trade-off: WAF rules can be bypassed and may cause false positives), restrict network access to the management interface to trusted internal IP ranges or a VPN rather than exposing it to the public internet (trade-off: breaks legitimate remote/public access), and enforce least-privilege on the application's database account so the web service cannot read tables beyond what it needs (trade-off: may break features that rely on broad DB access). If the vendor provides input-validation guidance or a configuration hotfix, apply it in preference to these interim measures.