https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-43360.htmlhttps://patchthecve.com/cve/CVE-2021-43360.htmlWed, 17 Jun 2026 04:10:53 +0000HIGH 8.8: Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restriction, which allows a post-authenticated remote attacker with database access privilege, to execute arbitrary code and control the system or interrupt services.https://patchthecve.com/cve/CVE-2021-43359.htmlhttps://patchthecve.com/cve/CVE-2021-43359.htmlWed, 17 Jun 2026 04:10:53 +0000HIGH 8.8: Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt services.https://patchthecve.com/cve/CVE-2021-43358.htmlhttps://patchthecve.com/cve/CVE-2021-43358.htmlWed, 17 Jun 2026 04:10:52 +0000HIGH 7.5: Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path traversal attacks without authentication, access restricted paths and download system files.https://patchthecve.com/cve/CVE-2020-10510.htmlhttps://patchthecve.com/cve/CVE-2020-10510.htmlWed, 17 Jun 2026 02:47:56 +0000HIGH 8.1: Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data.https://patchthecve.com/cve/CVE-2020-10509.htmlhttps://patchthecve.com/cve/CVE-2020-10509.htmlWed, 17 Jun 2026 02:47:56 +0000MEDIUM 6.1: Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the system and launch XSS attack.https://patchthecve.com/cve/CVE-2020-10508.htmlhttps://patchthecve.com/cve/CVE-2020-10508.htmlWed, 17 Jun 2026 02:47:56 +0000HIGH 7.5: Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.