What is the CVSS score of CVE-2026-33041?

CVE-2026-33041 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33041?

CVE-2026-33041 presents moderate security risk, a information exposure vulnerability rated CVSS 5.3. Sensitive information could be exposed to unauthorized parties.. A patch is available.

How to fix or mitigate CVE-2026-33041?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

PHP CVE-2026-33041

MEDIUM

Information Exposure (CWE-200)

2026-03-17 https://github.com/WWBN/AVideo

GHSA-px7x-gq96-rmp5

PHP Information Disclosure SQLi

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

Patch released

Mar 17, 2026 - 20:30 nvd

Patch available

CVE Published

Mar 17, 2026 - 19:48 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Summary

/objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes.

Details

File: objects/encryptPass.json.php

php

$obj->password = @$_REQUEST['pass'];
$obj->encryptedPassword = encryptPassword($obj->password);
echo json_encode($obj);

No authentication is required. The encryptPassword() function in objects/functions.php (line ~2101) uses:

php

function encryptPassword($password, $noSalt = false) {
    if (!empty($advancedCustomUser->encryptPasswordsWithSalt) && !empty($global['salt']) && empty($noSalt)) {
        $password .= $global['salt'];
    }
    return md5(hash('whirlpool', sha1($password)));
}

By default, salt is NOT enabled (encryptPasswordsWithSalt is off), making the hash deterministic and identical to what's stored in the database.

PoC

bash

# Get the hash for any password
curl 'https://TARGET/objects/encryptPass.json.php?pass=admin123'
# Response: {"password":"admin123","encryptedPassword":"<hash>"}
# Build a rainbow table for common passwords
for pass in $(cat rockyou-top1000.txt); do
  curl -s "https://TARGET/objects/encryptPass.json.php?pass=$pass"
done

If an attacker obtains password hashes from the database (via SQL injection, backup exposure, etc.), they can instantly crack them by comparing against pre-computed hashes from this endpoint.

Impact

Password Cracking Acceleration - This endpoint eliminates the need for an attacker to reverse-engineer the hashing algorithm. Combined with the weak hash chain (md5+whirlpool+sha1, no salt by default), an attacker with access to database hashes can crack passwords extremely quickly.

Additionally, this reveals whether salt is enabled and the exact hashing implementation, which is sensitive cryptographic configuration.

AnalysisAI

An unauthenticated attacker can leverage an exposed password hashing endpoint in PHP applications to obtain hashed versions of arbitrary passwords, facilitating offline cracking attacks against compromised database credentials. The vulnerable /objects/encryptPass.json.php file accepts user-supplied passwords via request parameters and returns their encrypted equivalents without authentication, effectively disclosing the application's hashing algorithm and salt to potential adversaries. This information disclosure has a CVSS score of 5.3 and patches are available.

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Information Exposure (CWE-200).

RemediationAI

A vendor patch is available — apply it immediately. Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.