CVE-2026-110104 — novel through 3.5.0 Unsalted MD5 Password Storage
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalte…
Published: 2026-10-13 · CVSS: 8.2 · CVSS 4.0
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7