CVE-2026-25861

The record

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.

Affected packages

Related vulnerabilities

• CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-916
• CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-916
• CVE-2026-81704 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the… CWE-916
• CVE-2026-81689 openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted… CWE-916
• CVE-2026-75112 A security issue exists within OTTO® Fleet Manager. CWE-916
• CVE-2026-74871 openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR… CWE-916
• CVE-2026-49005 The root password hash of the device can be obtained through unencrypted information in… CWE-916
• CVE-2026-55069 Kestra is an open-source, event-driven orchestration platform. CWE-916