CVE-2025-0585

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
aEnrich Technology	a+HRD	<= 7.5

References

https://www.twcert.org.tw/en/cp-139-8373-91edc-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-8372-19721-1.htmlThird Party Advisory

Timeline

Published: Jan 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-05867.2The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privil CVE-2025-05877.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. Thi CVE-2025-05884.9In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By s CVE-2025-05895.3In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated CVE-2025-05907.5Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-05917.8Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an appli CVE-2025-05928.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploadin CVE-2025-05938.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact wit CVE-2025-05958.7A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPER CVE-2025-05965.4A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIEN CVE-2025-05985.4A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R CVE-2025-05995.4A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPE