CVE-2026-26219
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The vulnerability in newbee-mall stores user passwords using an unsalted MD5 hashing algorithm. The lack of per-user salts and computational cost controls allows attackers who obtain password hashes via database exposure or backup leakage to quickly recover plaintext credentials through offline attacks.
Risk Assessment
The organization faces user identity theft and unauthorized system access, as attackers can easily crack passwords and take over accounts.
Recommendation
Immediately update the password storage mechanism to a secure salted algorithm such as bcrypt, scrypt, or Argon2, and force all users to change their passwords.
Other vulnerabilities in newbee-mall
See all- CVE-2026-26218Critical
The vulnerability in newbee-mall is due to pre-seeded administrator accounts in the database initialization script with a predictable default password. If deployments use this script and do not change the default credentials, unauthenticated attackers can log in as an administrator and gain full administrative control of the application.
- CVE-2026-105573Medium
A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-94045Low
A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.
- CVE-2025-10423Low
In newbee-mall 1.0, the mallKaptcha function in /common/mall/kaptcha produces a guessable captcha. The attack can be executed remotely, is of high complexity and difficult exploitability, and the exploit is publicly available.
- CVE-2025-10422Medium
In newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7, the paySuccess function in /paySuccess (Order Status Handler component) is vulnerable to manipulation of the orderNo argument leading to improper authorization. Remote exploitation is possible and the exploit has been publicly disclosed.
Original NVD description (English source)
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS