Humanist Digital Human Resources
Monthly
Observable response discrepancy in HUMANIST Digital Human Resources 26.0 exposes the system to unauthenticated account footprinting, enabling attackers to enumerate valid user accounts by analyzing differentiated server responses. The vulnerability is classified under CWE-204 and was reported by TR-CERT (Turkish national CERT), affecting the HR platform's authentication or account-lookup endpoints. No active exploitation has been identified in CISA KEV and no public exploit code is known, but the network-accessible, zero-authentication attack surface makes this a viable reconnaissance vector preceding credential-based attacks.
Insufficient session expiration in HUMANIST Digital Human Resources version 26.0 allows an attacker who obtains a valid session token to replay it indefinitely, effectively hijacking an authenticated user's session and gaining unauthorized access to HR data. Reported by TR-CERT (TR-26-0737), the flaw affects all 26.0 builds prior to 26.1 and carries a high confidentiality impact due to the sensitive nature of human resources data processed by the platform. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other platform users, including higher-privileged HR administrators. The vulnerability was disclosed by TR-CERT (advisory TR-26-0737) and is resolved in version 26.1. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Session hijacking is possible in HUMANIST Digital Human Resources (versions 26.0 through before 26.1) due to sensitive session tokens being transmitted as GET request query string parameters. Exposure occurs through server access logs, browser history, and HTTP Referer headers leaking to downstream systems. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the CVSS integrity and confidentiality impact ratings are both High, reflecting full session takeover potential.
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1) stems from a cryptographic key embedded directly in the application binary, letting attackers recover the same static key from any deployment and abuse it against protected data. Because the key is identical across all installations, its extraction undermines confidentiality and integrity of anything it protects. No public exploit identified at time of analysis, and the flaw was reported through Turkey's national CSIRT (TR-CERT).
Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to craft malicious URLs that silently forward victims to attacker-controlled phishing sites. The CVSS vector (PR:L/UI:R/S:C) confirms the vulnerability requires a low-privileged account to generate the redirect link and victim interaction to trigger it, with scope change reflecting cross-domain trust abuse. No public exploit code or active exploitation has been identified at time of analysis; this was reported by TR-CERT under advisory TR-26-0737.
Path traversal in HUMANIST Digital Human Resources version 26.0 enables authenticated remote attackers to read arbitrary files from the server filesystem without any user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a low-privilege account - consistent with a standard HR system employee login - with high confidentiality impact and no integrity or availability loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the vulnerability was disclosed by TR-CERT (Turkish national CERT) under advisory TR-26-0737.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticated attackers to upload a web shell to the server due to unrestricted file-type validation (CWE-434), resulting in full compromise of the HR application host. Any remote attacker can reach the upload functionality without credentials or user interaction and execute arbitrary commands. No public exploit identified at time of analysis, though the maximal CVSS 9.8 severity and trivial exploitability make this a high-priority fix for affected deployments.
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human Resources platform in versions 26.0 up to (but not including) 26.1, allowing remote attackers to compromise the underlying database and recover sensitive HR data that is stored without encryption. Rated CVSS 9.8 by TR-CERT with a fully remote, unauthenticated network vector and high impact to confidentiality, integrity, and availability. Currently there is no public exploit identified at time of analysis and no EPSS or KEV signal provided in the source data.
Observable response discrepancy in HUMANIST Digital Human Resources 26.0 exposes the system to unauthenticated account footprinting, enabling attackers to enumerate valid user accounts by analyzing differentiated server responses. The vulnerability is classified under CWE-204 and was reported by TR-CERT (Turkish national CERT), affecting the HR platform's authentication or account-lookup endpoints. No active exploitation has been identified in CISA KEV and no public exploit code is known, but the network-accessible, zero-authentication attack surface makes this a viable reconnaissance vector preceding credential-based attacks.
Insufficient session expiration in HUMANIST Digital Human Resources version 26.0 allows an attacker who obtains a valid session token to replay it indefinitely, effectively hijacking an authenticated user's session and gaining unauthorized access to HR data. Reported by TR-CERT (TR-26-0737), the flaw affects all 26.0 builds prior to 26.1 and carries a high confidentiality impact due to the sensitive nature of human resources data processed by the platform. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other platform users, including higher-privileged HR administrators. The vulnerability was disclosed by TR-CERT (advisory TR-26-0737) and is resolved in version 26.1. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Session hijacking is possible in HUMANIST Digital Human Resources (versions 26.0 through before 26.1) due to sensitive session tokens being transmitted as GET request query string parameters. Exposure occurs through server access logs, browser history, and HTTP Referer headers leaking to downstream systems. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the CVSS integrity and confidentiality impact ratings are both High, reflecting full session takeover potential.
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1) stems from a cryptographic key embedded directly in the application binary, letting attackers recover the same static key from any deployment and abuse it against protected data. Because the key is identical across all installations, its extraction undermines confidentiality and integrity of anything it protects. No public exploit identified at time of analysis, and the flaw was reported through Turkey's national CSIRT (TR-CERT).
Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to craft malicious URLs that silently forward victims to attacker-controlled phishing sites. The CVSS vector (PR:L/UI:R/S:C) confirms the vulnerability requires a low-privileged account to generate the redirect link and victim interaction to trigger it, with scope change reflecting cross-domain trust abuse. No public exploit code or active exploitation has been identified at time of analysis; this was reported by TR-CERT under advisory TR-26-0737.
Path traversal in HUMANIST Digital Human Resources version 26.0 enables authenticated remote attackers to read arbitrary files from the server filesystem without any user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a low-privilege account - consistent with a standard HR system employee login - with high confidentiality impact and no integrity or availability loss. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; the vulnerability was disclosed by TR-CERT (Turkish national CERT) under advisory TR-26-0737.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticated attackers to upload a web shell to the server due to unrestricted file-type validation (CWE-434), resulting in full compromise of the HR application host. Any remote attacker can reach the upload functionality without credentials or user interaction and execute arbitrary commands. No public exploit identified at time of analysis, though the maximal CVSS 9.8 severity and trivial exploitability make this a high-priority fix for affected deployments.
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human Resources platform in versions 26.0 up to (but not including) 26.1, allowing remote attackers to compromise the underlying database and recover sensitive HR data that is stored without encryption. Rated CVSS 9.8 by TR-CERT with a fully remote, unauthenticated network vector and high impact to confidentiality, integrity, and availability. Currently there is no public exploit identified at time of analysis and no EPSS or KEV signal provided in the source data.