Vulnerabilidades de aEnrich
CVEs publicadas que afetam produtos de aEnrich: 7 registro(s), com severidade, exploração e correções.
CVE-2026-6835
Média · 6.1
CWE-434 22/04/2026
aEnrich｜a+HCM - Arbitrary File Upload
The a+HCM developed by aEnrich has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload arbitrary files to any path, including HTML documents, which may result in a XSS-like effect.
CVE-2026-6834
Média · 6.5
CWE-862 22/04/2026
aEnrich｜a+HRD - Missing Authorization
The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method.
CVE-2026-6833
Média · 6.5
CWE-89 22/04/2026
aEnrich｜a+HRD - SQL Injection
The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2025-12872
Média · 5.4
CWE-79 12/11/2025
aEnrich｜eHRD - Stored Cross-Site Scripting
The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious JavaScript code, which will execute on the client side when a user is tricked into visiting a specific URL.
CVE-2025-12871
Crítica · 9.8
CWE-1390 12/11/2025
aEnrich｜a+HRD - Authentication Abuse
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
CVE-2025-12870
Crítica · 9.8
CWE-1390 12/11/2025
aEnrich｜eHRD - Authentication Abuse
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
CVE-2025-12869
Média · 4.8
CWE-79 12/11/2025
aEnrich｜eHRD - Stored Cross-Site Scripting
The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load.