CVE-2026-110104

The Xxyopen novel software (versions through 3.5.0 ) contains a weak password hashing vulnerability. The UserServiceImpl.register() function stores unsalted MD5 digests in the user_info.password field. If an attacker gains access to the password column via a database leak or backup exposure, they...