CVE-2026-105156 | YzmCMS up to 7.6 MD5 system.func.php password pass weak password hash

A vulnerability labeled as problematic has been found in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort.

The identification of this vulnerability is CVE-2026-105156. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor kindly explains: “Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (…) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk.”VulDB Recent EntriesRead More