CVE-2026-7103

A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized.

CVSS v3 3.7 LOW
CVSS v2.0 2.6 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://code-projects.org/
https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2
https://vuldb.com/submit/800384
https://vuldb.com/vuln/359678
https://vuldb.com/vuln/359678/cti
https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2

Configurations

No configuration.

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue determinada en code-projects Chat System 1.0. Afectada es una función desconocida del archivo update_user.PHP del componente MD5 Hash Gestor. Esta manipulación del argumento Password causa el uso de hash débil. El ataque es posible de ser llevado a cabo remotamente. La complejidad del ataque es calificada como alta. La explotabilidad se dice que es difícil. El exploit ha sido divulgado públicamente y puede ser utilizado.

Information

Published : 2026-04-27 09:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-7103

Mitre link : CVE-2026-7103

CVE.ORG link : CVE-2026-7103

JSON object : View

Products Affected

No product.

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-328

Use of Weak Hash

{"id": "CVE-2026-7103", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7103", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T12:27:19.588102Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:code-projects:chat_system:*:*:*:*:*:*:*:*"], "vendor": "code-projects", "modules": ["MD5 Hash Handler"], "product": "Chat System", "versions": [{"status": "affected", "version": "1.0"}]}]}], "published": "2026-04-27T09:16:03.127", "references": [{"url": "https://code-projects.org/", "source": "cna@vuldb.com"}, {"url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/800384", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/359678", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/359678/cti", "source": "cna@vuldb.com"}, {"url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized."}, {"lang": "es", "value": "Una vulnerabilidad fue determinada en code-projects Chat System 1.0. Afectada es una funci\u00f3n desconocida del archivo update_user.PHP del componente MD5 Hash Gestor. Esta manipulaci\u00f3n del argumento Password causa el uso de hash d\u00e9bil. El ataque es posible de ser llevado a cabo remotamente. La complejidad del ataque es calificada como alta. La explotabilidad se dice que es dif\u00edcil. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado."}], "lastModified": "2026-10-26T00:10:00.150", "sourceIdentifier": "cna@vuldb.com"}