ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code an…

An ERP application developed by PROG MIS contains a Use of Hard-coded Credentials vulnerability (CVE-2026-14807). The flaw allows unauthenticated remote attackers to log in to the application without valid credentials. Once logged in, attackers can view application source code and extract database account credentials and passwords. This vulnerability poses a significant risk as it requires no authentication and can be exploited remotely. The exposure of database credentials could lead to further compromise of underlying data systems. The issue was reported via Taiwan CERT (TWCERT) advisories. Hard-coded credentials are a critical security weakness classified under CWE-798. No authentication barrier exists for exploitation, making it immediately actionable for threat actors.