CVE-2025-32352
A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashe…
Published: 2025-04-05 · CVSS: 4.8 · CVSS 3.1
A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7