ERP App, developed by PROG MIS, includes hard‑coded credentials that allow any unauthenticated remote user to log in, view application code, and obtain database account names and passwords. This vulnerability enables credential theft, code discovery, and potential downstream attacks against the database, undermining both confidentiality and integrity of sensitive data.

Only the PROG MIS ERP App is known to be affected. Specific version numbers are not provided in the advisory; the vulnerability applies to all installed instances that contain the hard‑coded credentials.

The recorded CVSS score of 9.3 marks it as critical, but the EPSS score of less than 1% suggests that exploitation is presently unlikely. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. The attack vector is remote and unauthenticated; an attacker simply needs network access to the ERP application to hit the login endpoint and gain privileged access. Although exploitation might currently be rare, the high severity and potential for data exposure make it a top priority for remediation.