CVE-2026-6833

Vulnerability

Overview CVE-2026-6833 is a SQL injection vulnerability in a+HRD, a human resource management system developed by aEnrich. The flaw exists in an unspecified input parameter that fails to properly sanitize user-supplied data, allowing an authenticated attacker to inject arbitrary SQL commands into database queries [1][2].

Exploitation

Conditions An attacker must first authenticate to the application, but no special privileges beyond a standard user account are required. The attack vector is network-based (AV:N) with low attack complexity (AC:L), meaning the attacker can exploit the vulnerability remotely without physical access or complex prerequisites [1][2].

Impact

Successful exploitation enables the attacker to read arbitrary database contents, including sensitive information such as employee records, credentials, or other confidential data. The CVSS v3.1 score of 6.5 (Medium) reflects a high confidentiality impact with no impact on integrity or availability [1][2].

Mitigation

The vendor recommends upgrading to a+HRD version 6.8 or later and installing the latest security patches. Users should contact aEnrich customer service for assistance if upgrading is not immediately possible [1][2].