Threats affecting pkg:maven/lenve/vhr

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-90500 is a medium severity vulnerability in lenve vhr 1.0-SNAPSHOT affecting the Avatar Upload component. It allows unrestricted file upload via the FastDFSUtils.upload function in the /hr/userface file. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code is available. The vendor has not responded to disclosure attempts and no patch information is provided.

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A deserialization vulnerability exists in lenve vhr version 1.0-SNAPSHOT within the MailReceiver component. This flaw allows remote attackers to manipulate deserialization processing. The vulnerability has a medium severity score of 5.3 and public exploit code is available. The vendor has not responded to disclosure attempts, and no patch or remediation information is provided.