CVE-2026-25861
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
QloApps through version 1.7.0 uses the weak MD5 algorithm for password hashing in the Tools::encrypt() function. Attackers can perform offline brute-force attacks on these hashes, with the risk compounded by auto-generated 8-character passwords during guest-to-customer conversion.
Risk Assessment
Exposure of user passwords may lead to unauthorized account access and theft of sensitive data.
Recommendation
Immediately update QloApps to the patched version (commit 64e9722) and switch to a stronger hashing algorithm such as bcrypt.
Other vulnerabilities in QloApps
See all- CVE-2025-67325Critical
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
- CVE-2026-25558Medium
QloApps through version 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager. Authenticated administrators can inject malicious JavaScript by uploading crafted SVG files with embedded event handlers such as onload.
Original NVD description (English source)
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.