Xxyopen Novel CVE-2026-110104

Exploitation requires the attacker to FIRST obtain the contents of the user_info.password column - through a database leak, SQL injection, stolen/exposed backup, or insider access - since the MD5 digests are stored server-side and not exposed by any application feature. Once the column is obtained, the limiting factor is only password strength: unsalted MD5 digests are trivially cracked for weak/common passwords via rainbow tables and resist cracking only for high-entropy passwords. This affects Xxyopen novel (github.com/201206030/novel) through version 3.5.0; instances already migrated to the BCrypt fix, or whose users have all re-logged-in (triggering the opportunistic BCrypt upgrade in the patched login path), are no longer affected. The vulnerability is not remotely triggerable on its own - it is a confidentiality-amplifier conditioned on a separate data-exposure event.

This is a CWE-916 weak-password-storage flaw (unsalted MD5 in user_info.password) rather than a directly exploitable network vulnerability, and the signals should be read with that in mind. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H) scores 8.2, but the critical nuance is AT:P - an 'attack requirement' is present, meaning exploitation is NOT self-contained over the network: the attacker must first obtain the password column via a separate database leak or backup exposure, as the description itself states. The high CVSS is driven entirely by VC:H (confidentiality of recovered plaintext credentials). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automatable exploitation; this is a latent data-protection weakness, not an imminent remote-exploitation priority. Treat it as a defense-in-depth / credential-hygiene issue whose real-world severity is contingent on a prior breach of the database - the AV:N network metric overstates reachability because the MD5 digests are not themselves exposed by any network-facing feature. Patch is confirmed available (BCrypt migration), which lowers remediation risk.

An attacker who already obtains the user_info table - via a SQL injection, a misconfigured backup, or an insider database dump - extracts the 32-character unsalted MD5 password digests. Because the hashes are unsalted, the attacker runs them against precomputed rainbow tables or GPU-accelerated brute force to recover plaintext passwords, then reuses those credentials against this application and any other service where users reused them. No public exploit identified at time of analysis; the 'exploit' is standard offline hash cracking.