CVE-2022-28741

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-09 · updated 2026-06-17
Weakness: CWE-22

Description

aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validation in v5.x

Affected products

aEnrich a+HRD: from 5.0 before 5.4.1125v112; from 5.5 before 5.5.1098v156; from 5.6 before 5.6.1067v110; from 6.0 before 7.0 — fixed in 5.4.1125v112, 5.5.1098v156, 5.6.1067v110, 7.0

How to fix

Upgrade to a fixed version: aEnrich a+HRD 5.4.1125v112, 5.5.1098v156, 5.6.1067v110, 7.0. Check the vendor advisory for mitigations.

References

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0035/MNDT-2022-0035.md
https://www.aenrich.com.tw
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0035/MNDT-2022-0035.md
https://www.aenrich.com.tw

Get alerted when CVE-2022-28741 or the next vulnerability affects your stack