CVE-2026-25861

Katalog CVE

CVSS 5.9 · Medium EPSS 0,27%

Kerentanan Use of Password Hash With Insufficient Computational Effort. Skor CVSS 3.1 5.9 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.

Rincian

Terbit di NVD

2 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Deferred

CVSS 3.1

5.9 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Qloapps/QloApps/commit/64e9722e7e6a8fda77dd53964d988fb6b5c3d174
• https://github.com/Qloapps/QloApps/pull/1689
• https://www.vulncheck.com/advisories/qloapps-weak-password-hashing-via-md5-in-tools-php