CVE-2026-7103

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7103", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T09:04:38.568Z", "datePublished": "2026-04-27T08:30:10.652Z", "dateUpdated": "2026-04-27T12:27:23.279Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T08:30:10.652Z"}, "title": "code-projects Chat System MD5 Hash update_user.php weak hash", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-328", "lang": "en", "description": "Use of Weak Hash"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "Risky Cryptographic Algorithm"}]}], "affected": [{"vendor": "code-projects", "product": "Chat System", "versions": [{"version": "1.0", "status": "affected"}], "cpes": ["cpe:2.3:a:code-projects:chat_system:*:*:*:*:*:*:*:*"], "modules": ["MD5 Hash Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T11:09:44.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "c4ttr4ck (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/359678", "name": "VDB-359678 | code-projects Chat System MD5 Hash update_user.php weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359678/cti", "name": "VDB-359678 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/800384", "name": "Submit #800384 | code-projects Chat System Using PHP 1.0 nsecure Direct Object Reference (IDOR) + SQL Injection + Weak Pa", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2", "tags": ["related"]}, {"url": "https://code-projects.org/", "tags": ["product"]}], "tags": ["x_freeware"]}, "adp": [{"references": [{"url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T12:27:19.588102Z", "id": "CVE-2026-7103", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:27:23.279Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7103", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T12:27:19.588102Z"}}}], "references": [{"url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:26:45.323Z"}}], "cna": {"tags": ["x_freeware"], "title": "code-projects Chat System MD5 Hash update_user.php weak hash", "credits": [{"lang": "en", "type": "reporter", "value": "c4ttr4ck (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:code-projects:chat_system:*:*:*:*:*:*:*:*"], "vendor": "code-projects", "modules": ["MD5 Hash Handler"], "product": "Chat System", "versions": [{"status": "affected", "version": "1.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T11:09:44.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359678", "name": "VDB-359678 | code-projects Chat System MD5 Hash update_user.php weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359678/cti", "name": "VDB-359678 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/800384", "name": "Submit #800384 | code-projects Chat System Using PHP 1.0 nsecure Direct Object Reference (IDOR) + SQL Injection + Weak Pa", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2", "tags": ["related"]}, {"url": "https://code-projects.org/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "Use of Weak Hash"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T08:30:10.652Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7103", "state": "PUBLISHED", "dateUpdated": "2026-04-27T12:27:23.279Z", "dateReserved": "2026-04-26T09:04:38.568Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-27T08:30:10.652Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:code-projects:chat_system:*:*:*:*:*:*:*:*"], "modules": ["MD5 Hash Handler"], "product": "Chat System", "vendor": "code-projects", "versions": [{"status": "affected", "version": "1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized."}, {"lang": "es", "value": "Una vulnerabilidad fue determinada en code-projects Chat System 1.0. Afectada es una funci\u00f3n desconocida del archivo update_user.PHP del componente MD5 Hash Gestor. Esta manipulaci\u00f3n del argumento Password causa el uso de hash d\u00e9bil. El ataque es posible de ser llevado a cabo remotamente. La complejidad del ataque es calificada como alta. La explotabilidad se dice que es dif\u00edcil. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado."}], "id": "CVE-2026-7103", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7103", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T12:27:19.588102Z", "version": "2.0.3"}}]}, "published": "2026-04-27T09:16:03.127", "references": [{"source": "cna@vuldb.com", "url": "https://code-projects.org/"}, {"source": "cna@vuldb.com", "url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/800384"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359678"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359678/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0,1.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Chat System", "source": "cna", "vendor": "code-projects"}, "product": "chat_system", "vendor": "code-projects"}], "analysis": {"en": {"generated_at": "2026-04-28T04:41:34.080549+00:00", "value": {"mitigation_remediation": ["Replace the MD5 hash in update_user.php with a modern password\u2011hashing algorithm such as bcrypt, Argon2, or PBKDF2, ensuring unique salts per user.", "Verify that the updated code correctly hashes, stores, and verifies passwords, and remove any legacy MD5 checks from the codebase.", "Deploy the patch to a staging environment first, test authentication flow thoroughly, then roll out to production while monitoring authentication logs for anomalies."], "summary": {"action": "Patch or Upgrade Hashing", "impact": "Password confidentiality compromise due to weak MD5 hashing"}, "threat_synthesis": {"affected_systems": "Affected product is the code-projects Chat System, specifically version 1.0. The vulnerability is tied to the MD5 Hash Handler in the update_user.php file. No other versions or upstream products are explicitly listed, so only this version is confirmed to be vulnerable.", "description_and_impact": "code-projects Chat System 1.0 contains a flaw in update_user.php where the password argument is hashed with the outdated MD5 algorithm. The CWE-327 and CWE-328 weaknesses allow an attacker to preprocess or brute\u2011force the hash, potentially revealing user passwords. Because the flaw resides in the authentication component, compromised passwords could lead to unauthorized account access.", "risk_and_exploitability": "CVSS score 6.3 indicates a moderate risk. EPSS <1% shows that public exploitation is unlikely, and the vulnerability is not in the CISA KEV catalog. The attack vector is remote, with a high complexity and difficult exploitability as stated, but the public disclosure means the threat is still present. Organizations running the vulnerable version should treat this as a medium\u2011severity threat until a proper cryptographic solution is in place."}}}}, "created": "2026-04-28T01:00:09.474299+00:00", "updated": "2026-04-28T04:45:22.552900+00:00", "vendors": ["code-projects", "code-projects$PRODUCT$chat_system"]}