VULNERABILITY INTELLIGENCE

CVE-2026-26219

CVSS score9.1 CRITICAL
EPSS probability0.22%
CISA KEVNot currently listed
Published2026-02-12
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.

Weakness classification

  • disclosure@vulncheck.com: CWE-327

Primary references