CVE-2026-105156 YzmCMS MD5 system.func.php password weak password hash
Attackers can crack user passwords due to weak MD5 hashing in YzmCMS, requiring high complexity but enabling credential theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105156?
CVE-2026-105156 is a medium-severity vulnerability in YzmCMS, published on 4 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."
Which versions are affected by CVE-2026-105156?
How do I fix CVE-2026-105156?
No fix has been published for CVE-2026-105156 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105156 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105156 exists.
Sources
Also known as GHSA-h259-j8qc-grcv.