Weak password encoding in Płatnik
Płatnik versions up to metric 242 in version 10.02.002 are affected. CVSS rates the issue high at 7.7, and the vendor gives no separate severity rating.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in metric 242
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Płatnik software, a Polish application used for managing social insurance contributions, is affected by this vulnerability. An attacker who obtains a stored encoded password could easily decode it and recover the original password.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 242 in version 10.02.002.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Zakład Ubezpieczeń Społecznych Płatnik
fixed in metric 242
References 2
Questions about CVE-2026-110971
What does this mean?
Passwords in Płatnik are encoded in a weak way. Someone who obtains an encoded password can easily decode it back to the plaintext password.Source: cert.pl
Am I affected, and how do I check?
The advisory covers Płatnik versions up to metric 242 in version 10.02.002, meaning all builds before the fix. To check a installation, look up its version and metric number in the Płatnik version information.Source: cert.pl
What should I do about it?
Update Płatnik to metric 242 or later within version 10.02.002. The sources do not include a separate fix notice, so confirm the fixed build with the vendor before relying on it.Source: cert.pl
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data