aEnrich vulnerabilities
We track 12 vulnerabilities in aEnrich products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2025.
Latest aEnrich vulnerabilities
- 9.8 Critical severity
a+HRD: Weak Authentication
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
- 9.8 Critical severity
a+HRD: Weak Authentication
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
- 7.5 High severity
a+HRD: Improper Neutralization of Argument Delimiters in a Command
aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.
- 9.8 Critical severity
a+HRD: Deserialization of Untrusted Data
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system
- 9.8 Critical severity
a+HRD: Deserialization of Untrusted Data
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disru
- 9.8 Critical severity
a+HRD: Improper Authentication
aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access API function to perform arbitrary system command or disrupt service.
- 9.8 Critical severity
a+HRD: Improper Neutralization of Special Elements used in an SQL Command
aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database.
- 7.5 High severity
a+HRD: Improper Limitation of a Pathname to a Restricted Directory
aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
- 9.8 Critical severity
a+HRD: Server-Side Request Forgery
aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s) request to launch Server-Side Request Forgery (SSRF) attack, to perform arbitrary system command or
- 8.1 High severity
A+hrd: Improper Limitation of a Pathname to a Restricted Directory
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validation in v5.x
- 9.8 Critical severity
a+HRD: Incorrect Authorization
aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service.
- 7.5 High severity
a+HRD: Improper Limitation of a Pathname to a Restricted Directory
aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass authentication and perform path traversal attacks to access arbitrary files under website root directory.