Threats tagged 'ghsa-h259-j8qc-grcv'

CVE-2026-105156 is a medium severity vulnerability in YzmCMS versions 7.0 through 7.6. It involves the Password function in the MD5 Handler component, which produces password hashes with insufficient computational effort. This weakness could be exploited remotely but requires high complexity and is difficult to exploit. The vendor plans to release a backward-compatible gradual hash migration feature in March 2027 and will provide interim mitigation guidance. No official patch is currently available.