Threats tagged 'ghsa-x9fh-7c86-cq87'

CVE-2026-90500 is a medium severity vulnerability in lenve vhr 1.0-SNAPSHOT affecting the Avatar Upload component. It allows unrestricted file upload via the FastDFSUtils.upload function in the /hr/userface file. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code is available. The vendor has not responded to disclosure attempts and no patch information is provided.