CVE-2026-110217

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the...

CVE-2026-110217 vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the...

CVE-2026-110217

The Lenve vhr application (through commit 03abbd3 ) contains an information disclosure vulnerability. This flaw allows any authenticated user to access other operators' BCrypt password hashes by sending a GET request to the /chat/hrs endpoint. Specifically, low-privileged operators can retrieve s...

CVE-2026-90501

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...

CVE-2026-90500

A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...

CVE-2026-90501 lenve vhr HrMapper.xml HrInfoController.updateHr privileges management

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...

EUVD-2026-76974

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...

CVE-2026-90501

CVE-2026-90501 affects the lenve vhr application (version 1.0-SNAPSHOT ). The vulnerability resides in the HrInfoController.updateHr function within HrMapper.xml , where manipulation of the Password argument leads to improper privilege management (mass assignment privilege escalation, per the ass...

CVE-2026-90501 lenve vhr HrMapper.xml HrInfoController.updateHr privileges management

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...

EUVD-2026-76973

A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...

CVE-2026-90500 lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload

A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...

CVE-2026-90500 lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload

A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...

CVE-2026-90500

lenve vhr 1.0-SNAPSHOT is affected by an unrestricted file upload vulnerability in the Avatar Upload component, specifically in the function FastDFSUtils.upload within the file /hr/userface . The root cause is improper validation of the File argument, allowing remote attackers with low privileges...

CVE-2026-90499

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The...

CVE-2026-90498

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

EUVD-2026-76971

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The...

CVE-2026-90499 lenve vhr Password Update pass HrInfoController.updatePass improper authorization

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The...

CVE-2026-90499 lenve vhr Password Update pass HrInfoController.updatePass improper authorization

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The...

CVE-2026-90499

A vulnerability in lenve vhr 1.0-SNAPSHOT affects the Password Update Handler component, specifically the HrInfoController.updatePass function in the /hr/pass file. The root cause is improper authorization resulting from manipulation of the hrid argument, allowing a remote attacker with low privi...

EUVD-2026-76972

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...