CVE-2026-26219
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The vulnerability in newbee-mall stores user passwords using an unsalted MD5 hashing algorithm. The lack of per-user salts and computational cost controls allows attackers who obtain password hashes via database exposure or backup leakage to quickly recover plaintext credentials through offline attacks.
Risk Assessment
The organization faces user identity theft and unauthorized system access, as attackers can easily crack passwords and take over accounts.
Recommendation
Immediately update the password storage mechanism to a secure salted algorithm such as bcrypt, scrypt, or Argon2, and force all users to change their passwords.
Other vulnerabilities in newbee-mall
See all- CVE-2026-26218Critical
The vulnerability in newbee-mall is due to pre-seeded administrator accounts in the database initialization script with a predictable default password. If deployments use this script and do not change the default credentials, unauthenticated attackers can log in as an administrator and gain full administrative control of the application.
- CVE-2026-105573Medium
A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-94045Low
A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.
Original NVD description (English source)
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS