CVE-2026-90498

lenve vhr vhr.sql default credentials

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The flaw in Lenve VHR 1.0‑SNAPSHOT allows an attacker to modify the vhr.sql file to bypass authentication and use default credentials. Based on the description, it is inferred that this can allow unauthenticated remote access. The weakness involves incorrect credential handling as identified by CWE‑1392.

Affected Systems

The affected product is Lenve V‑SNAPSHOT build. No additional version details are provided beyond the snapshot identifier. Users operating this version should verify that they are not using the default configuration or that any exposed interfaces that modify SQL files are secured.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. The EPSS score is < 1%, suggesting a very low but non‑zero likelihood that this vulnerability will be exploited. Publicly available exploits exist, based on the description it is inferred that an attacker with access to the application or its web interface could manipulate vhr.sql and log in with default credentials. The vulnerability is not listed in CISA’s KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest Lenve VHR release that removes the default credential usage.
  • Immediately change any remaining default usernames and passwords in the application configuration.
  • Disable or secure any feature that allows direct modification of SQL files or scripts exposed to the network.

Generated by OpenCVE AI on September 15, 2026 at 17:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title lenve vhr vhr.sql default credentials
First Time appeared Lenve
Lenve vhr
Weaknesses CWE-1392
CPEs cpe:2.3:a:lenve:vhr:*:*:*:*:*:*:*:*
Vendors & Products Lenve
Lenve vhr
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 15, 2026, 2:00 PM
Reserved
Sep 12, 2026, 8:23 AM

View source JSON

Updated
Sep 15, 2026, 1:47 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 7:17 AM
Modified
Sep 15, 2026, 3:17 PM

View source JSON

No data.

Updated
Sep 15, 2026, 5:30 PM

JSON