CVE-2026-14838

7.4 HIGH

Published 2026-08-04 · Updated 2026-08-04

AI risk analysis

Summary: The flaw is a session hijacking vulnerability due to sensitive query strings being exposed via GET requests. This matters because attackers can exploit it to take over user sessions.
Exploitability: Exploitation requires access to sensitive query parameters, making it moderately difficult but feasible with proper reconnaissance.
Blast radius: If exploited, the impact could be significant as it allows full session hijacking, potentially leading to unauthorized access and data breaches.
Prioritized remediation: Update to HUMANIST Digital Human Resources version 26.1 or later which addresses this vulnerability.

session-hijackingwebvulnerabilityupdate

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-598

All references

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0737

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.