CVE-2025-12869
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript code that executes in users' browsers upon page load.
Risk Assessment
An attacker with administrator privileges can execute arbitrary JavaScript in users' browsers, potentially leading to session theft or actions on behalf of victims.
Recommendation
Upgrade a+HRD to a patched version or implement input filtering and output encoding; restrict administrative privileges to necessary personnel.
Other vulnerabilities in a+HRD
See all- CVE-2025-12871Critical
The a+HRD developed by aEnrich has an authentication abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
- CVE-2025-12870Critical
The a+HRD product by aEnrich has an Authentication Abuse vulnerability allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
Original NVD description (English source)
The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS