MEDIUMCVSS v3.1 4.4Vulnerability
CVE-2026-129127
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss score
- 4.4
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 4.4
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-129127
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
- Published at
- 2026-11-13T17:17:30.130
- Last modified
- 2026-11-13T21:17:46.483
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph