TVN ID	TVN-202607002
CVE ID	CVE-2026-14808, CVE-2026-14809
CVSS	【CVE-2026-14808】 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 【CVE-2026-14809】 7.5 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products	Prog Management System
Description	【CVE-2026-14808(Exposure of Sensitive Information)】 Unauthenticated remote attackers can view a specific page and obtain the database account and password. 【CVE-2026-14809(SQL Injection)】 Unauthenticated remote attackers can inject arbitrary SQL commands to read database contents.
Solution	Contact the vendor for patching.
Credit	Ruki Ren、Leo Huang (AAA Security)
Public Date	2026-07-06