CVE-2026-90498: lenve vhr vhr.sql default credentials
Published Sep 13, 2026
·Updated
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
1 affected component
lenve/vhr=1.0-SNAPSHOT
Event History
Sep 13, 2026
CVE Published
via MITRE·06:15 AM
Data Sourced
via MITRE·06:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are known to be affected?
The issue is identified in lenve vhr version 1.0-SNAPSHOT, involving unknown functionality in the vhr.sql file.
2
Does an attacker need an account or user interaction to exploit this issue?
No privileges and no user interaction are required according to the provided attack vector. Remote exploitation is possible.
3
How likely is exploitation in the near term?
A public exploit is available and may be used. The vendor was contacted but did not provide a response.