Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-105156: YzmCMS creates easily cracked password hashes

CVE-2026-105156 · published 14 days ago

Summary

YzmCMS versions up to 7.6 use a simple MD5 method to store passwords, making them faster to crack. This weak hashing can be abused by attackers who can send specially crafted data to the system. Apply the vendor's temporary mitigation steps now and plan to upgrade to the March 2027 release that adds stronger, gradual hash migration.

Original advisory text

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-326Inadequate Encryption Strength

CWE-916Use of Password Hash With Insufficient Computational Effort

Timeline

Published4 Oct 2026

Updated15 Oct 2026

First seen4 Oct 2026

Sources

CVE-2026-105156 · NVD

Track software like this

Free during beta