106 matches found
EUVD-2026-102484
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...
CVE-2026-111330
JuggleIM im-server versions through 1.8.16 are vulnerable to a weak password hashing vulnerability. The application uses unsalted SHA-1 digests (via tools.SHA1) to store admin console passwords in the services/accountservice.go component. If an attacker gains access to the accounts table through ...
CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...
CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...
CVE-2026-110104
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register stores unsalted MD5 digests in userinfo.password. Attackers who obtain the password column through a database leak or backup exposure ca...
CVE-2026-110104 novel through 3.5.0 Unsalted MD5 Password Storage
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register stores unsalted MD5 digests in userinfo.password. Attackers who obtain the password column through a database leak or backup exposure ca...
CVE-2026-110104: Use of Password Hash With Insufficient Computational Effort
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register stores unsalted MD5 digests in userinfo.password. Attackers who obtain the password column through a database leak or backup exposure ca...
CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...
CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...
CVE-2026-81946
The PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) uses MD5-based password hashing in firmware versions prior to 1.2412b260707 (V1) and 2.2412b260519 (V2). Because MD5 is a cryptographically weak algorithm, an attacker who obtains the device configuration file can recover the privil...
CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...
EUVD-2026-81576
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...
CVE-2026-92921
admin3 (versions through 3.0.0 ) stores account passwords using single-round MD5 with only the username as salt and no key derivation function, as seen in its SecurityUtil.java and UserCredential.java source files. Because MD5 is computationally inexpensive, an attacker with database access can r...
CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...
CVE-2026-92921 admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...
EUVD-2026-73927
A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possib...
CVE-2026-80211
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...
PT-2026-82563
Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.4.21 Description User passwords are stored and verified as unsalted MD5 digests. The application fails to use per-password salts or adaptive hashing functions, meaning identical passwords result in identical...
CVE-2026-75112: Use of Password Hash With Insufficient Computational Effort
A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...
