CVE-2026-110104highCWE-916

CVE-2026-110104: falha de alta gravidade em xxyopen novel

novel through 3.5.0 Unsalted MD5 Password Storage

Publicada em

Seguir esta CVE+ Monitorar novel

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.3%
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
xxyopen · novel
CVEs relacionadas — xxyopen novel

No mesmo produto, das mais perigosas para as menos.

CVE-2026-123677MEDIUMxxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorizationEPSS —CVE-2026-123676MEDIUMxxyopen/201206030 novel Book Content Service BookServiceImpl.java BookServiceImpl.getBookContentAbout improper authorizationEPSS —