CVE-2026-14192 describes a stored cross-site scripting (CWE-79) vulnerability in HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc. The vulnerability arises from improper input neutralization during web page generation, enabling attackers with low privileges and requiring user interaction to execute malicious scripts in a way that impacts confidentiality and integrity but not availability. It affects version 26.0 and is fixed starting from version 26.1. No official patch or remediation advisory is currently provided in the data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial confidentiality and integrity compromise of user data. The vulnerability does not impact availability. Exploitation requires low privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects version 26.0 and is fixed in 26.1, upgrading to version 26.1 or later is recommended once the vendor releases the update. Until then, limit exposure by restricting user privileges and exercising caution with user-generated content.