CVE-2026-112029— diem-project diem SHA1 PluginDmUser.class.php weak password hash
Quick assessment
Affected
diem-project diem
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 diem-project 的 diem 项目（版本 5.1.3 及更早版本）中发现了一个漏洞。该漏洞影响组件 SHA1 Handler 中文件 的未知部分。对 salt（盐值）或 password（密码）参数的不当操作会导致生成的密码哈希值计算复杂度不足。该攻击需在本地执行，且实施难度较高，表明其利用难度较大。该漏洞的利用方法已公开披露，可能被攻击者利用。项目方已通过问题报告在早期获知此问题，但截至目前尚未作出回应。
Possible ATT&CK Techniques 1 AI
T1110.001 · Password GuessingAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| diem-project | diem | 5.1.0 |
affected |
5.1.1 |
affected | ||
5.1.2 |
affected | ||
5.1.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112029
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
diem-project diem SHA1 PluginDmUser.class.php weak password hash
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用具有不充分计算复杂性的口令哈希
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| diem-project | diem | 5.1.0 |
cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-112029
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112029
请登录查看更多情报信息。
Other References for CVE-2026-112029 (2)
IV. Related Vulnerabilities
Same product: diem
-
CVE-2026-112138
diem-project diem dmCodeEditor actions.class.php join path t -
CVE-2026-112042
diem-project diem dmWidget dmBaseLinkTag.php text cross site -
CVE-2026-112041
diem-project diem dmString.php random weak prng -
CVE-2026-112040
diem-project diem Sign-In BasedmUserActions.class.php redire -
CVE-2026-112039
diem-project diem Administrative Console actions.class.php a
Same vendor: diem-project
-
CVE-2026-112138
diem-project diem dmCodeEditor actions.class.php join path t -
CVE-2026-112042
diem-project diem dmWidget dmBaseLinkTag.php text cross site -
CVE-2026-112041
diem-project diem dmString.php random weak prng -
CVE-2026-112040
diem-project diem Sign-In BasedmUserActions.class.php redire -
CVE-2026-112039
diem-project diem Administrative Console actions.class.php a
Same weakness: CWE-916
-
CVE-2026-112026
light0011 cms UserModel.class.php sha1 weak password hash -
CVE-2026-111330
JuggleIM im-server through 1.8.16 Weak Password Hashing via -
CVE-2026-110104
novel through 3.5.0 Unsalted MD5 Password Storage -
CVE-2026-107829
Jivejdon through 5.0 Unsalted MD5 Password Storage via Accou -
CVE-2026-105804
Payload: Password hashes use insufficient PBKDF2 iterations
V. Comments for CVE-2026-112029
No comments yet