Answer Brief
TWCERT/CC published a Taiwan Vulnerability Note (TVN-202604004) for two vulnerabilities affecting Yuqi Digital Technology’s a+HRD product in versions 7.1 and earlier. The issues—SQL injection (CVE-2026-6833) and missing authorization (CVE-2026-6834)—could allow an authenticated remote attacker to read database contents. TWCERT/CC advises upgrading to a patched release referenced by the vendor’s security notice.
Executive Summary: TWCERT/CC published a Taiwan Vulnerability Note (TVN-202604004) for two vulnerabilities affecting Yuqi Digital Technology’s a+HRD product in versions 7.1 and earlier. The issues—SQL injection (CVE-2026-6833) and missing authorization (CVE-2026-6834)—could allow an authenticated remote attacker to read database contents. TWCERT/CC advises upgrading to a patched release referenced by the vendor’s security notice.
Why It Matters
This disclosure is notable for identity and enterprise risk teams because both vulnerabilities are remotely reachable and require only authenticated access (PR:L), implying that compromise of low-privilege accounts—or abuse of legitimate but overly broad accounts—could lead to high-impact confidentiality exposure (C:H) of backend HR data.
From an infrastructure and cloud-security perspective, HR platforms are commonly integrated with identity providers, payroll/ERP systems, and reporting pipelines. Even when the CVSS ratings are “Medium,” the described outcomes (arbitrary database reads) can create outsized downstream risk: data leakage, cross-system correlation, and potential regulatory exposure depending on the database contents.
For global security programs, the Taiwan CERT signal matters because a+HRD is a regional enterprise product that may sit inside multinational subsidiaries’ environments. Centralized monitoring often under-covers locally deployed line-of-business applications; this is a recurring gap in cloud and hybrid asset inventories. The report also highlights two classic control failures—input handling (SQL injection) and authorization enforcement (missing authorization)—that can bypass intended role-based access controls at the API/data layer.
TWCERT/CC recommends upgrading to a version and applying the latest corresponding patch per the vendor’s security notice (or contacting the vendor’s support). The bulletin does not state whether exploitation has been observed in the wild.
Event Type: security
Importance: medium
Affected Companies
- DEVCORE
- TWCERT/CC (Taiwan Computer Emergency Response Team/Coordination Center)
- 育碁數位科技 (Yuqi Digital Technology)
Affected Sectors
- Cybersecurity
- Enterprise software
- HR technology
Key Numbers
- TVN ID: TVN-202604004
- Affected product versions: a+HRD 7.1 and earlier
- CVE-2026-6833 CVSS v3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- CVE-2026-6834 CVSS v3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Timeline
- TWCERT/CC publishes TVN-202604004 covering CVE-2026-6833 and CVE-2026-6834 for a+HRD.