light0011 cms UserModel.class.php sha1 password weak password hash

Summaryinfo

A vulnerability categorized as problematic has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password results in weak password hash. This vulnerability is cataloged as CVE-2026-112026. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability was found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. It has been classified as problematic. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument password with an unknown input leads to a weak password hash vulnerability. CWE is classifying the issue as CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. This is going to have an impact on confidentiality.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-112026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet. By approaching the search of inurl:App/Home/Model/UserModel.class.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-104007). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Vendor

• light0011

Name

• cms

Version

• c774dce31c6df0055568a8d5c53d964d99be199d
• f72cf46f601efb2a0618c3814cc2f61380b38930

Website

• Product: https://github.com/light0011/cms/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1008071: light0011 cms f72cf46f601efb2a0618c3814cc2f61380b38930 Use of Weak Hash (by gscsd)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion