https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T05:44:51.101637+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336592 EUVD-2026-336592 2026-10-07T05:44:51.168153+00:00 EUVD-2026-336592 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25861 fkie_cve-2026-25861 2026-10-07T05:44:51.168201+00:00

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.

 https://cve.radiocsirt.org/vuln/ghsa-xcxp-3whg-h83c GHSA-xcxp-3whg-h83c 2026-10-07T05:44:51.168252+00:00

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.