Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112026— light0011 cms UserModel.class.php sha1 weak password hash

Quick assessment

Affected
light0011 cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 light0011 CMS 项目（提交哈希 c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930）中发现一个安全漏洞。受影响的是文件 App/Home/Model/UserModel.class.php 中的 sha1 函数。由于对 Password 参数的处理不当，导致生成的密码哈希值所需的计算强度不足。该攻击可从远程发起，但实施难度较高，需要较高的技术复杂度。利用该漏洞的难度较大，不过相关利用方法已

CVSS 3.7 · Low EPSS 0.20% · P10
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112026

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
light0011 cms UserModel.class.php sha1 weak password hash
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用具有不充分计算复杂性的口令哈希
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d cpe:2.3:a:light0011:cms:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-112026

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112026

请登录查看更多情报信息。

Proof of Concept for CVE-2026-112026 (1)

Other References for CVE-2026-112026 (1)

Same Patch Batch · light0011 · 2026-10-18 · 4 CVEs total

CVE-2026-112025 7.3 HIGH light0011 cms Captcha Validation UserController.class.php access control
CVE-2026-112028 6.5 MEDIUM light0011 cms Vote VoteController.class.php logic error
CVE-2026-112027 5.3 MEDIUM light0011 cms Uploadify check-exists.php file_exists file information disclosure

IV. Related Vulnerabilities

Same product: cms
Same vendor: light0011
Same weakness: CWE-916

V. Comments for CVE-2026-112026

No comments yet

Leave a comment