CVE-2025-12869

None

CVSS

—

EPSS

0.2%

Published

Nov 12, 2025

CISA due date

—

The record

The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript codes that are executed in users' browsers upon page load.

Affected packages

Ecosystem	Package	Introduced	Fixed