CVE-2025-12869: aEnrich｜eHRD - Stored Cross-Site Scripting

Q: What is the severity of CVE-2025-12869?

CVE-2025-12869 has a medium severity rating due to its potential for exploitation through persistent cross-site scripting.

Q: Who is affected by CVE-2025-12869?

CVE-2025-12869 affects the aEnrich eHRD application when run with administrator privileges.

Q: How do I fix CVE-2025-12869?

To fix CVE-2025-12869, ensure that user input is properly sanitized and implement output encoding to prevent script injection.

Q: What kind of attacks can CVE-2025-12869 enable?

CVE-2025-12869 can enable remote attackers to execute malicious JavaScript code in the browsers of users who visit the affected application.

Q: Is user authentication important for CVE-2025-12869?

Yes, proper user authentication and role management are crucial to mitigate the risks associated with CVE-2025-12869.

Published Nov 12, 2025

Updated

The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load.

Affected Software

2 affected components

aEnrich eHRD

aEnrich A\+hrd<=7.5

Remediation

Information

Please refer to the aEnrich advisory to upgrade to version 6.8 or later and install the latest patches, or contact aEnrich customer service for assistance.

Event History

Nov 12, 2025

CVE Published

via MITRE·07:30 AM

Data Sourced

via MITRE·07:30 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-12869?

CVE-2025-12869 has a medium severity rating due to its potential for exploitation through persistent cross-site scripting.

Who is affected by CVE-2025-12869?