CVE-2026-6833

CVE-2026-6833 is a SQL injection vulnerability affecting aEnrich's a+HRD application that allows authenticated remote attackers to inject arbitrary SQL commands and read sensitive database contents. The vulnerability requires valid user credentials but can be executed over the network with minimal complexity. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network attack vector and low attack complexity. While the impact is limited to confidentiality breach with no capability to modify or disrupt data, the ability to extract database contents presents a meaningful risk for organizations using this product. Current exploitation activity appears minimal, with no known exploit code in public circulation and no designation on the Known Exploited Vulnerabilities catalog. The EPSS score of 0.00035 indicates this vulnerability is currently ranked below the 0.10% threshold for empirical exploitation probability. However, the FAUCET risk score of 44.0 suggests moderate concern warranting timely patching, particularly for instances containing sensitive data accessible to authenticated users.