Aenrich A\+hrd
20 CVEs affecting Aenrich A\+hrd. Latest disclosed: 2025-11-12. Critical: 9, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12871 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and us… |
CVE-2025-12870 | Critical | 9.8 | 2025-11-12 | The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administr… |
CVE-2025-0585 | Critical | 9.8 | 2025-01-20 | The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify… |
CVE-2023-20853 | Critical | 9.8 | 2023-04-27 | aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote atta… |
CVE-2023-20852 | Critical | 9.8 | 2023-04-27 | aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit t… |
CVE-2022-39042 | Critical | 9.8 | 2023-01-03 | aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access… |
CVE-2022-39041 | Critical | 9.8 | 2023-01-03 | aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject ar… |
CVE-2022-39039 | Critical | 9.8 | 2023-01-03 | aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s… |
CVE-2022-26676 | Critical | 9.8 | 2022-04-07 | aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to con… |
CVE-2022-28741 | High | 8.1 | 2022-09-09 | aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validati… |
CVE-2022-39040 | High | 7.5 | 2023-01-03 | aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication… |
CVE-2022-28742 | High | 7.5 | 2022-09-09 | aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when acces… |
CVE-2022-28740 | High | 7.5 | 2022-09-09 | aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-26675 | High | 7.5 | 2022-04-07 | aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass authentication and perform path traversal… |
CVE-2025-0586 | High | 7.2 | 2025-01-20 | The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular sy… |
CVE-2025-0583 | Medium | 6.1 | 2025-01-20 | The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript… |
CVE-2025-0584 | Medium | 5.3 | 2025-01-20 | The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal… |
CVE-2024-3775 | Medium | 5.3 | 2024-04-15 | aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitr… |
CVE-2024-3774 | Medium | 5.3 | 2024-04-15 | aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing att… |
CVE-2025-12869 | Medium | 4.8 | 2025-11-12 | The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent Ja… |