aEnrich vulnerabilities
Published CVEs affecting aEnrich products: 7 record(s), with severity, exploitation and fixes.
CVE-2026-6835
Medium · 6.1
CWE-434 Apr 22, 2026
aEnrich｜a+HCM - Arbitrary File Upload
The a+HCM developed by aEnrich has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload arbitrary files to any path, including HTML documents, which may result in a XSS-like effect.
CVE-2026-6834
Medium · 6.5
CWE-862 Apr 22, 2026
aEnrich｜a+HRD - Missing Authorization
The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method.
CVE-2026-6833
Medium · 6.5
CWE-89 Apr 22, 2026
aEnrich｜a+HRD - SQL Injection
The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2025-12872
Medium · 5.4
CWE-79 Nov 12, 2025
aEnrich｜eHRD - Stored Cross-Site Scripting
The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious JavaScript code, which will execute on the client side when a user is tricked into visiting a specific URL.
CVE-2025-12871
Critical · 9.8
CWE-1390 Nov 12, 2025
aEnrich｜a+HRD - Authentication Abuse
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
CVE-2025-12870
Critical · 9.8
CWE-1390 Nov 12, 2025
aEnrich｜eHRD - Authentication Abuse
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
CVE-2025-12869
Medium · 4.8
CWE-79 Nov 12, 2025
aEnrich｜eHRD - Stored Cross-Site Scripting
The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load.