EUVD-2026-52646
GHSA-qhjg-59pv-84j4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated SQL injection with low complexity and no user interaction yields full C/I/A impact on the application database; scope unchanged.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
AnalysisAI
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human Resources platform in versions 26.0 up to (but not including) 26.1, allowing remote attackers to compromise the underlying database and recover sensitive HR data that is stored without encryption. Rated CVSS 9.8 by TR-CERT with a fully remote, unauthenticated network vector and high impact to confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the HUMANIST Digital Human Resources web application running an affected version (26.0 through before 26.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, remote, unauthenticated attack with maximal impact - consistent with classic exploitable SQL injection. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker submits a crafted parameter to a vulnerable HUMANIST input field or endpoint, injecting SQL that is executed against the backend database. Because sensitive HR records are stored in cleartext, the attacker directly exfiltrates personal, credential, or payroll data and can modify or delete records, impacting confidentiality, integrity, and availability. … |
| Remediation | Upgrade HUMANIST Digital Human Resources to version 26.1 or later, which is the first release outside the affected range; treat 26.1 as the fix per the affected-version boundary, though no explicit vendor-released patch version string was independently confirmed in the input. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and isolate all HUMANIST instances running versions 26.0 through 26.0.x by restricting network access to essential administrators only and implementing firewall rules to block external connections to affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticat
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1
Session hijacking is possible in HUMANIST Digital Human Resources (versions 26.0 through before 26.1) due to sensitive s
Insufficient session expiration in HUMANIST Digital Human Resources version 26.0 allows an attacker who obtains a valid
Path traversal in HUMANIST Digital Human Resources version 26.0 enables authenticated remote attackers to read arbitrary
Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persiste
Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to cr
Observable response discrepancy in HUMANIST Digital Human Resources 26.0 exposes the system to unauthenticated account f
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allShare
External POC / Exploit Code
Leaving vuln.today