EUVD-2026-24599
GHSA-7fr2-w4c8-798j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
AnalysisAI
SQL injection in aEnrich a+HRD allows authenticated remote attackers to read database contents through malicious SQL command injection. The vulnerability requires low-privilege authentication but enables complete confidentiality breach of database information. No active exploitation confirmed via CISA KEV, and EPSS data not available, but the low attack complexity (AC:L) and network attack vector (AV:N) make this exploitable by any authenticated user with basic SQL injection knowledge.
Technical ContextAI
This is a classic SQL injection vulnerability (CWE-89) in the a+HRD human resources management system developed by aEnrich. SQL injection occurs when user-supplied input is improperly sanitized before being incorporated into SQL queries, allowing attackers to manipulate query logic. The CVSS 4.0 vector indicates network-accessible exploitation with low complexity, suggesting the vulnerable input points are likely in web-based interfaces such as search forms, report filters, or data retrieval endpoints common in HR systems. The CPE identifier (cpe:2.3:a:aenrich:a+hrd) encompasses the a+HRD product line, though specific vulnerable versions are not enumerated in available data.
RemediationAI
Consult aEnrich vendor support immediately to obtain patched version information, as no specific fix version is documented in the Taiwan CERT advisories at https://www.twcert.org.tw/tw/cp-132-10833-e3a53-1.html or https://www.twcert.org.tw/en/cp-139-10834-eb3ee-2.html. Until a patch is applied, implement database-level compensating controls: configure the a+HRD database account with read-only permissions where feasible (note: this may break application functionality requiring write operations), enable database query logging to detect injection attempts (trade-off: performance overhead and log storage requirements), restrict network access to the a+HRD application to trusted IP ranges via firewall rules (limits remote attack surface but does not prevent insider exploitation), and deploy web application firewall rules to block common SQL injection patterns in HTTP requests (risk: potential false positives blocking legitimate queries with special characters). These controls reduce but do not eliminate risk; vendor patching remains the primary remediation path.
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. Rated cri
aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to uplo
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability th
aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user inpu
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. Rated high severity (C
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Ac
aEnrich a+HRD has inadequate filtering for special characters in URLs. Rated high severity (CVSS 7.5), this vulnerabilit
Missing authorization in a+HRD API allows authenticated low-privilege remote attackers to read arbitrary database conten
aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restriction
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to c
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to s
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today