Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.9
CVE-2026-112026: light0011 CMS weak SHA-1 password hashing
CVE-2026-112026 · published today
Summary
The content management system light0011 CMS stores passwords using the outdated SHA‑1 algorithm, which can be broken more easily than modern methods. This makes it possible for attackers to guess or reverse passwords if they gain access to the password data. Update the system to use a stronger password‑hashing method or apply a patch that replaces SHA‑1 with a more secure algorithm.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| light0011 | cms | c774dce31c6df0055568a8d5c53d964d99be199d |
Original advisory text
light0011 cms UserModel.class.php sha1 weak password hash
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
2.9
Low
Type
CWE-916Use of Password Hash With Insufficient Computational Effort
CWE-326Inadequate Encryption Strength
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta