https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:44:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-198793 EUVD-2026-198793 https://cve.radiocsirt.org/vuln/euvd-2026-198793 https://cve.radiocsirt.org/vuln/fkie_cve-2024-51478 <p>YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.</p> <p>YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-51478 https://cve.radiocsirt.org/vuln/ghsa-4fvx-h823-38v3 <p><strong>Affected:</strong> Packagist: yeswiki/yeswiki</p> <p>### Summary The use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account.</p> <p>### Details Firstly, the salt used to hash the password reset key is hard-coded in the `includes/services/UserManager.php` file at line `36` :</p> <p>```php private const PW_SALT = &#39;FBcA&#39;; ```</p> <p>Next, the application uses a weak cryptographic algorithm to hash the password reset key. The hash algorithm is defined in the `includes/services/UserManager.php` file at line `201` :</p> <p>```php protected function generateUserLink($user) { // Generate the password recovery key $key = md5($user[&#39;name&#39;] . &#39;_&#39; . $user[&#39;email&#39;] . random_int(0, 10000) . date(&#39;Y-m-d H:i:s&#39;) . self::PW_SALT); ```</p> <p>The key is generated from the **user&#39;s name**, **e-mail address**, a random number **between 0 and 10000**, the **current date** of the request and the **salt**. If we know the user&#39;s name and e-mail address, we can retrieve the key and use it to reset the account password with a bit of brute force on the random number.</p> <p>### Proof of Concept (PoC) To demonstrate the vulnerability, I created a python script to automatically retrieve the key and reset the password of a provided username and email.</p> <p>```python #!/usr/bin/env python3 # -*- coding: utf-8 -*- # Author: Nishacid # YesWiki &lt;= 4.4.4 Account Takeover via Weak Password Reset Crypto</p> <p>from hashlib import md5 from requests import post, get from base64 import b64encode f…</p> <p><strong>Affected:</strong> Packagist: yeswiki/yeswiki</p> <p>### Summary The use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account.</p> <p>### Details Firstly, the salt used to hash the password reset key is hard-coded in the `includes/services/UserManager.php` file at line `36` :</p> <p>```php private const PW_SALT = &#39;FBcA&#39;; ```</p> <p>Next, the application uses a weak cryptographic algorithm to hash the password reset key. The hash algorithm is defined in the `includes/services/UserManager.php` file at line `201` :</p> <p>```php protected function generateUserLink($user) { // Generate the password recovery key $key = md5($user[&#39;name&#39;] . &#39;_&#39; . $user[&#39;email&#39;] . random_int(0, 10000) . date(&#39;Y-m-d H:i:s&#39;) . self::PW_SALT); ```</p> <p>The key is generated from the **user&#39;s name**, **e-mail address**, a random number **between 0 and 10000**, the **current date** of the request and the **salt**. If we know the user&#39;s name and e-mail address, we can retrieve the key and use it to reset the account password with a bit of brute force on the random number.</p> <p>### Proof of Concept (PoC) To demonstrate the vulnerability, I created a python script to automatically retrieve the key and reset the password of a provided username and email.</p> <p>```python #!/usr/bin/env python3 # -*- coding: utf-8 -*- # Author: Nishacid # YesWiki &lt;= 4.4.4 Account Takeover via Weak Password Reset Crypto</p> <p>from hashlib import md5 from requests import post, get from base64 import b64encode f…</p> https://cve.radiocsirt.org/vuln/ghsa-4fvx-h823-38v3