{"schemaVersion":3,"id":"CVE-2026-7103","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized.","dates":{"published":"2026-04-27T08:30:10.652Z","modified":"2026-04-27T12:27:23.279Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"CVE.org","score":2.6,"severity":"low","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":2.9,"severity":"low","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":2.6,"severity":"low","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00282,"percentile":0.19474,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.09400000000000001,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00188},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00282,"percentile":0.19474}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00188,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00282,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00282,"percentile":0.19474}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-327","name":"Use of a Broken or Risky Cryptographic Algorithm","description":"The product uses a broken or risky cryptographic algorithm or protocol.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/327.html"},{"id":"CWE-328","name":"Use of Weak Hash","description":"The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/328.html"}],"affected":[{"vendor":"code-projects","product":"chat_system","name":"chat system","label":"chat_system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0","eol":null,"hubHref":"/vendor/code-projects/chat_system"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://vuldb.com/vuln/359678","label":"vuldb.com/vuln/359678","hostname":"vuldb.com","tags":["VDB Entry","Technical Description"]},{"url":"https://vuldb.com/vuln/359678/cti","label":"vuldb.com/vuln/359678/cti","hostname":"vuldb.com","tags":["Signature","Permissions Required"]},{"url":"https://vuldb.com/submit/800384","label":"vuldb.com/submit/800384","hostname":"vuldb.com","tags":["Third Party Advisory"]},{"url":"https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2","label":"gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2","hostname":"gist.github.com","tags":["Related"]},{"url":"https://code-projects.org/","label":"code-projects.org","hostname":"code-projects.org","tags":["Product"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-04-27T08:30:10.652Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T12:27:23.279Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T10:34:50.279Z","stale":false,"partial":false}}