CVE-2026-90501
MediumCVSS 6.3Summary
A vulnerability was detected in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updateHr function in HrMapper.xml. Manipulation of the Password argument leads to improper privilege management. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker could escalate privileges within the HR system, potentially gaining unauthorized access to employee data and administrative functions.
Recommendation
Restrict network access to the vhr application to trusted networks and apply a patch as soon as it becomes available. Review logs for unusual changes to HR data.
Other vulnerabilities in lenve vhr
See all- CVE-2026-90500Medium
A weakness was identified in lenve vhr 1.0-SNAPSHOT affecting the FastDFSUtils.upload function in /hr/userface (Avatar Upload component). Manipulation of the File argument causes unrestricted upload. The attack can be carried out remotely and the exploit is publicly available.
- CVE-2026-90499Medium
A security flaw was discovered in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updatePass function in /hr/pass (Password Update Handler component). Manipulation of the hrid argument results in improper authorization. The attack can be executed remotely and the exploit has been released to the public.
- CVE-2026-90498High
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT involving the use of default credentials in the vhr.sql file. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond to the disclosure.
Original NVD description (English source)
A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.