CVE-2026-14807 CRITICAL

CVE-2026-14807: PROG MIS｜ERP App - Use of Hard-coded Credentials

Vendor Prog Mis

Product ERP App

Weakness CWE-798 · Hardcoded credentials

Published July 6, 2026

Last update July 6, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code and obtain the database account and password.

Key dates

02Disclosure timeline

July 6, 2026 CVE published

July 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-14807 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/798.html AskarLabs — CWE-798 write-up Use of Hard-coded Credentials

Related vulnerabilities

04Related CVE

CVE-2025-58656 WordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure Vulnerability CVE-2024-5810 WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials CVE-2025-10850 Felan Framework <= 1.1.4 - Hardcoded Credentials CVE-2026-1233 Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access CVE-2025-58659 WordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerability