The a+HRD software by aEnrich contains a SQL Injection vulnerability (CWE-89) that permits authenticated remote attackers to inject malicious SQL commands. This flaw enables attackers to read sensitive database contents without requiring user interaction and with low attack complexity. The CVSS 4.0 base score is 7.1, reflecting a high severity due to the potential data exposure. No patch or official remediation guidance is currently available, and the product is not a cloud service, so remediation depends on vendor action.

Successful exploitation allows authenticated attackers to read arbitrary database contents, compromising data confidentiality. The vulnerability does not require user interaction and has low attack complexity, increasing the risk of data exposure. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, restrict authenticated access to trusted users only and consider additional database access controls to limit potential impact.