TVN ID	TVN-202511005
CVE ID	CVE-2025-12869, CVE-2025-12870, CVE-2025-12871, CVE-2025-12872
CVSS	CVE-2025-12869： 4.8 (Medium) CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2025-12870： 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2025-12871： 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2025-12872： 5.4 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products	a+HRD version 7.5 and earlier： CVE-2025-12869, CVE-2025-12870, CVE-2025-12871, CVE-2025-12872 a+HCM version 8.1： CVE-2025-12872
Description	CVE-2025-12869： The a+HRD has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load. CVE-2025-12870： The a+HRD has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges. CVE-2025-12871： The a+HRD has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges. CVE-2025-12872： The a+HRD and a+HCM have a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious JavaScript code, which will execute on the client side when a user is tricked into visiting a specific URL.
Solution	Please refer to the aEnrich advisory to upgrade to version 6.8 or later and install the latest patches, or contact aEnrich customer service for assistance.
Credit	CVE-2025-12869： Wxi (Systex Software) CVE-2025-12870, CVE-2025-12871： Tree(CHT Security) CVE-2025-12872： Loki, Harry, Mike, Henry, WoodMan(安華聯網)
Public Date	2025-11-12