CVE-2026-116054Low· 2.2▾ TwilightPoC availableA security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is po…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 12.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.
SH3 n/aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112029Low· 2.5diem-project diem SHA1 PluginDmUser.class.php weak password hash
CVE-2026-112026Low· 3.7light0011 cms UserModel.class.php sha1 weak password hash
CVE-2026-105156Low· 3.7A weakness has been identified in YzmCMS up to 7.6
CVE-2026-86670Low· 3.7A flaw has been found in aircheng-org iWebShop-5 up to 5.15
CVE-2026-110104Medium· 5.9Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform