The Bog Management System has two high-risk vulnerabilities: CVE-2026-14808 (Critical, CVSS 9.8, sensitive info exposure) and CVE-2026-14809 (High,
The Bog Management System has recently been found to have two high-risk security vulnerabilities, namely CVE-2026-14808 and CVE-2026-14809. The Taiwan Computer Emergency Response and Coordination Center (TWCERT) issued a TVN announcement (TVN ID: TVN-202607002) on July 6, 2026, formally disclosing this threat[1]. Among them, CVE-2026-14808 belongs to "Exposure of Sensitive Information," with a CVSS 3.1 score as high as 9.8, rated as Critical; while CVE-2026-14809 is "SQL Injection," with a CVSS score of 7.5, classified as High[1]. Both vulnerabilities allow unauthenticated remote attackers to exploit them directly without any login privileges[1].
CVE-2026-14808 has an extremely simple attack path: attackers can directly obtain the database account and password simply by browsing a specific page in the system[1]. This vulnerability stems from the system's failure to implement proper authentication and access control for sensitive information pages, resulting in database credentials being exposed in plain text or readable form on the web.
CVE-2026-14809 involves a typical SQL injection flaw. Attackers can bypass the system's authentication mechanism and directly read database contents by injecting arbitrary SQL commands[1]. Since attackers do not require authentication, any remote user who can access the system entry point can launch this attack, posing extremely high risk[1].
The affected product is currently clearly identified as Bog Management System; the announcement does not mention specific version numbers[1].
Regarding these two vulnerabilities, TWCERT explicitly recommends contacting the vendor for remediation; no official update package beyond temporary mitigation measures has been provided yet[1].