Lenve
Monthly
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to overwrite arbitrary HR profiles - including administrator accounts - via the PUT /hr/info endpoint by supplying a victim's profile ID in the request body. The flaw stems from a complete absence of object-level authorization in HrInfoController.java: the server updates whichever record ID is provided without verifying the requester owns or has permission to modify it. Beyond profile data manipulation, an attacker can disable administrator accounts, effectively causing a denial-of-service against system administration functions. No vendor-released patch has been identified at time of analysis.
Missing authorization on the PUT /hr/pass endpoint in vhr (through commit 03abbd3) allows any authenticated user who knows a target account's current password to change that account's password - a classic IDOR via CWE-639. The server accepts an arbitrary account ID in the request body without verifying it matches the session owner, enabling cross-account credential takeover by low-privileged insiders. SSVC flags a POC as available and assesses technical impact as total; no vendor-released patch has been identified at time of analysis.
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through the avatar upload endpoint, bypassing server-side validation entirely. The vulnerable function FastDFSUtils.upload at the /hr/userface endpoint accepts multipart file submissions without enforcing file-type or content-type restrictions, enabling upload of web shells or other malicious payloads to the FastDFS distributed storage backend. A proof-of-concept exploit is publicly available and the vendor has not responded to disclosure, leaving no official patch in place.
Improper authorization in lenve vhr 1.0-SNAPSHOT allows authenticated low-privilege users to change the password of any arbitrary employee record by supplying a manipulated `hrid` parameter to the `/hr/pass` endpoint, enabling horizontal privilege escalation and account takeover across the HR application. The flaw in `HrInfoController.updatePass` accepts the target employee identifier from client input without verifying that the requesting session holds rights over that specific record - a classic IDOR pattern classified under CWE-285. A public proof-of-concept exists via GitHub advisory; the vendor was unresponsive to coordinated disclosure, and no patch has been released.
Default credential exposure in lenve vhr 1.0-SNAPSHOT allows unauthenticated remote attackers to authenticate as a privileged application user by submitting credentials embedded verbatim in the vhr.sql database seed file. A public proof-of-concept advisory (VHR-VULN-008) documents the specific credentials, removing any discovery barrier. The vendor did not respond to responsible disclosure, leaving no official patch available and the default credentials in place across all unmodified deployments.
Deserialization of untrusted data in the MailReceiver component of lenve vhr 1.0-SNAPSHOT enables authenticated remote attackers to manipulate application state and potentially execute arbitrary code via crafted serialized payloads. A YAKIT-based proof-of-concept exploit is publicly available on GitHub. The CVSS 4.0 score of 5.3 reflects low-privilege authentication as a prerequisite and limited per-component impact, though Java deserialization flaws can exceed their scored impact if exploitable gadget chains exist in the runtime classpath.
A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as problematic was found in lenve VBlog up to 1.0.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) in the vhr open-source HR management system allows any authenticated user to overwrite arbitrary HR profiles - including administrator accounts - via the PUT /hr/info endpoint by supplying a victim's profile ID in the request body. The flaw stems from a complete absence of object-level authorization in HrInfoController.java: the server updates whichever record ID is provided without verifying the requester owns or has permission to modify it. Beyond profile data manipulation, an attacker can disable administrator accounts, effectively causing a denial-of-service against system administration functions. No vendor-released patch has been identified at time of analysis.
Missing authorization on the PUT /hr/pass endpoint in vhr (through commit 03abbd3) allows any authenticated user who knows a target account's current password to change that account's password - a classic IDOR via CWE-639. The server accepts an arbitrary account ID in the request body without verifying it matches the session owner, enabling cross-account credential takeover by low-privileged insiders. SSVC flags a POC as available and assesses technical impact as total; no vendor-released patch has been identified at time of analysis.
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through the avatar upload endpoint, bypassing server-side validation entirely. The vulnerable function FastDFSUtils.upload at the /hr/userface endpoint accepts multipart file submissions without enforcing file-type or content-type restrictions, enabling upload of web shells or other malicious payloads to the FastDFS distributed storage backend. A proof-of-concept exploit is publicly available and the vendor has not responded to disclosure, leaving no official patch in place.
Improper authorization in lenve vhr 1.0-SNAPSHOT allows authenticated low-privilege users to change the password of any arbitrary employee record by supplying a manipulated `hrid` parameter to the `/hr/pass` endpoint, enabling horizontal privilege escalation and account takeover across the HR application. The flaw in `HrInfoController.updatePass` accepts the target employee identifier from client input without verifying that the requesting session holds rights over that specific record - a classic IDOR pattern classified under CWE-285. A public proof-of-concept exists via GitHub advisory; the vendor was unresponsive to coordinated disclosure, and no patch has been released.
Default credential exposure in lenve vhr 1.0-SNAPSHOT allows unauthenticated remote attackers to authenticate as a privileged application user by submitting credentials embedded verbatim in the vhr.sql database seed file. A public proof-of-concept advisory (VHR-VULN-008) documents the specific credentials, removing any discovery barrier. The vendor did not respond to responsible disclosure, leaving no official patch available and the default credentials in place across all unmodified deployments.
Deserialization of untrusted data in the MailReceiver component of lenve vhr 1.0-SNAPSHOT enables authenticated remote attackers to manipulate application state and potentially execute arbitrary code via crafted serialized payloads. A YAKIT-based proof-of-concept exploit is publicly available on GitHub. The CVSS 4.0 score of 5.3 reflects low-privilege authentication as a prerequisite and limited per-component impact, though Java deserialization flaws can exceed their scored impact if exploitable gadget chains exist in the runtime classpath.
A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as problematic was found in lenve VBlog up to 1.0.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.