CVE-2026-90498
HighCVSS 7.3Summary
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT involving the use of default credentials in the vhr.sql file. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond to the disclosure.
Risk Assessment
Use of default credentials allows remote attackers to gain unauthorized access to the system. The public availability of the exploit increases the risk of compromise.
Recommendation
Immediately change all default credentials in the vhr.sql file and the database. It is also recommended to verify whether the system has already been compromised.
Other vulnerabilities in lenve vhr
See all- CVE-2026-90501Medium
A vulnerability was detected in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updateHr function in HrMapper.xml. Manipulation of the Password argument leads to improper privilege management. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-90500Medium
A weakness was identified in lenve vhr 1.0-SNAPSHOT affecting the FastDFSUtils.upload function in /hr/userface (Avatar Upload component). Manipulation of the File argument causes unrestricted upload. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2026-90499Medium
A security flaw was discovered in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updatePass function in /hr/pass (Password Update Handler component). Manipulation of the hrid argument results in improper authorization. The attack can be executed remotely and the exploit has been released to the public.
Original NVD description (English source)
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.