CVE-2026-112026

The record

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages

Related vulnerabilities

• CVE-2026-77405 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-326
• CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-326
• CVE-2026-17520 The Newsletters WordPress plugin before 4.17 does not generate its API key using a… CWE-326
• CVE-2026-47842 Applications using AesBytesEncryptor with the two-argument constructor or when passing a… CWE-326
• CVE-2026-79084 Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to… CWE-326
• CVE-2026-74889 openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in… CWE-326
• CVE-2026-65777 Inadequate encryption strength in Windows Active Directory allows an authorized attacker… CWE-326
• CVE-2026-9201 IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute… CWE-326