CVE-2026-116054

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116054", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-10-24T21:30:36.601Z", "datePublished": "2026-10-25T14:15:11.104Z", "dateUpdated": "2026-10-29T20:08:38.135Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-25T14:15:11.104Z"}, "title": "SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-916", "lang": "en", "description": "Password Hash With Insufficient Computational Effort"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-326", "lang": "en", "description": "Inadequate Encryption Strength"}]}], "affected": [{"vendor": "n/a", "product": "SH3", "versions": [{"version": "n/a", "status": "affected"}], "cpes": ["cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:*"], "modules": ["M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in SH3. This affects an unknown function of the component M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.2, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.2, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:N/AC:H/Au:M/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-10-24T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-10-24T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-24T23:35:43.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "0x5ea3o1f (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/426138", "name": "VDB-426138 | SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/426138/cti", "name": "VDB-426138 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-116054", "name": "CVE-2026-116054 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/997072", "name": "Submit #997072 | SH3 Inform\u00e1tica Ltda M\u00f3dulo de Gest\u00e3o, M\u00f3dulo de Arrecada\u00e7\u00e3o <2026.0.2.0 Storing Passwords in a Recoverable Format", "tags": ["third-party-advisory"]}, {"url": "https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial", "tags": ["broken-link", "exploit"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T20:08:29.023464Z", "id": "CVE-2026-116054", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T20:08:38.135Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116054", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T20:08:29.023464Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T20:08:33.862Z"}}], "cna": {"title": "SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash", "credits": [{"lang": "en", "type": "reporter", "value": "0x5ea3o1f (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.2, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.2, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:N/AC:H/Au:M/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o"], "product": "SH3", "versions": [{"status": "affected", "version": "n/a"}]}], "timeline": [{"lang": "en", "time": "2026-10-24T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-10-24T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-24T23:35:43.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/426138", "name": "VDB-426138 | SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/426138/cti", "name": "VDB-426138 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-116054", "name": "CVE-2026-116054 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/997072", "name": "Submit #997072 | SH3 Inform\u00e1tica Ltda M\u00f3dulo de Gest\u00e3o, M\u00f3dulo de Arrecada\u00e7\u00e3o <2026.0.2.0 Storing Passwords in a Recoverable Format", "tags": ["third-party-advisory"]}, {"url": "https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial", "tags": ["broken-link", "exploit"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in SH3. This affects an unknown function of the component M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-916", "description": "Password Hash With Insufficient Computational Effort"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-326", "description": "Inadequate Encryption Strength"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-25T14:15:11.104Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116054", "state": "PUBLISHED", "dateUpdated": "2026-10-29T20:08:38.135Z", "dateReserved": "2026-10-24T21:30:36.601Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-25T14:15:11.104Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:*"], "modules": ["M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o"], "product": "SH3", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in SH3. This affects an unknown function of the component M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended."}], "id": "CVE-2026-116054", "lastModified": "2026-10-29T21:17:12.633", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:M/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.2, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116054", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T20:08:29.023464Z", "version": "2.0.3"}}]}, "published": "2026-10-25T15:17:01.307", "references": [{"source": "cna@vuldb.com", "url": "https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-116054"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/997072"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/426138"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/426138/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}, {"lang": "en", "value": "CWE-916"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.0.2.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "sh3", "vendor": "sh3"}], "created": "2026-10-25T20:15:14.466728+00:00", "updated": "2026-11-03T16:37:48.692235+00:00", "vendors": ["sh3", "sh3$PRODUCT$sh3"]}