【Vulnerability Alert】BPMero｜HCM - SQL Injection

• Subject: 【Vulnerability Alert】BPMero｜HCM - SQL Injection

• Description:
  • Forwarded from Taiwan Computer Emergency Response Team / Coordination Center Security Advisory TWCERTCC-200-202607-00000010
  • 【BPMero｜HCM - SQL Injection 】(CVE-2026-15804, CVSS: 8.8) An SQL Injection vulnerability exists in HCM developed by BPMero. An authenticated remote attacker can inject SQL commands through specific parameters, affecting the confidentiality, integrity, and availability of database data.
• Affected Platforms:
  • HCM versions 7 to 7.5.3 (exclusive), HCM versions 8 to 8.1.7.1 (exclusive)
• Recommended Actions:
  • Please update to HCM version 7.5.3 (inclusive) or later, Please update to HCM version 8.1.7.1 (inclusive) or later
• References:
  1. https://www.twcert.org.tw/tw/cp-132-11035-5c640-1.html

Computer and Communication Center
Network System Division