5.9
MediumCVSS 3.1 · from VulnCheck
CVE-2026-25861
QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php
QloApps · CWE-916 · CWE-916AffectedQloApps
FixA patch is linked in the references.
PublishedJun 2, 22:09 · VulnCheck
ScoredJun 2 · 5.9 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read data. CVSS impact.
Description
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inQloAppsup to 1.7.0–QloApps64e9722e7e6a8fda77dd53964d988fb6b5c3d174–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known