← Back to the live CVE advisory feed

CVE-2026-105156: YzmCMS

Severity

2.9 (LOW)

Affected versions

7.0; 7.1; 7.2

Patch status

Unknown

Published

2026-10-04T15:16:30.050

Modified

2026-10-04T15:16:30.050

Why it matters

Vulnerability requiring standard triage and vendor validation.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (…) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."

View the official NVD record for CVE-2026-105156

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.