Lenve vulnerabilities
We track 5 vulnerabilities in Lenve products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 13, 2026.
Latest Lenve vulnerabilities
- 7.3 High severity
vhr: Use of Default Credentials
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly ava
- 8.1 High severity
vhr: Authorization Bypass Through User-Controlled Key
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts inc
- 7.5 High severity
vhr: Authorization Bypass Through User-Controlled Key
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in
- 9.8 Critical severity
VBlog: Incorrect Privilege Assignment
A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access control
- 9.8 Critical severity
VBlog: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Affected is the function uploadImg of the file blogserver/src/main/java/org/sang/controller/ArticleController.java. The manipulation of the argument filename leads to path traver