YzmCMS CVE-2026-105156

Exploitation requires the attacker to first obtain YzmCMS's stored password hashes - typically through database access, an exposed/leaked backup, or a separate injection vulnerability - because the weakness is in how the MD5 Handler in /common/function/system.func.php computes password hashes (no computationally expensive or salted algorithm), not in a direct network-accessible code path. The flaw itself does not grant access; it only enables efficient offline cracking of already-exfiltrated hashes. Limiting factors: affects YzmCMS versions up to and including 7.6; high attack complexity per the vendor and CVSS (AC:H); impact is limited to credential confidentiality (VC:L) with no integrity or availability effect; and no vendor patch exists until the planned March 2027 release, with only interim mitigation guidance promised.

This is a design/hardening weakness (CWE-916, use of MD5 for password storage), not a directly exploitable remote flaw, and the available signals converge on LOW real-world priority despite a medium CVSS 4.0 base score of 6.3. The CVSS vector (AV:N/AC:H/PR:N/UI:N) nominally marks it network-reachable and unauthenticated, but that is misleading for a hashing weakness: the vulnerable-system impact is confidentiality-only and partial (VC:L, VI:N, VA:N), and the high attack complexity (AC:H) plus the vendor's own 'exploitability is considered difficult' framing reflect that an attacker cannot exploit weak hashing directly over the network - they must first obtain the password hash store and then crack it offline. Exploit maturity is Proof-of-Concept (E:P) with public POC code referenced on GitHub, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. CONFLICTING SIGNAL TO VERIFY: the CVSS vector implies remote unauthenticated network attack (AV:N/PR:N), yet the nature of the weakness implies the attacker needs prior access to stored hashes - treat the 'network/unauthenticated' labeling as formal CVSS scoring rather than a real standalone remote attack path. Net: a legitimate defense-in-depth finding worth remediating on schedule, not an emergency.

An attacker who obtains the YzmCMS user table - for example via a separate SQL injection, an exposed database backup, or a server compromise - finds that passwords are stored as MD5 hashes with insufficient computational cost. Because MD5 is extremely cheap to compute, the attacker rapidly recovers plaintext passwords offline using GPU brute-force or precomputed rainbow tables, then reuses those credentials against YzmCMS accounts or other services. Public proof-of-concept material is available, though exploitation still depends on first acquiring the hashes.