This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-25861 | BDVDB-2026-337276 Detail

QloAppsQloApps

Description#

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-916 Use of Password Hash With Insufficient Computational Effort

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.