CVE-2026-92921
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.
- Published Sep 17, 2026
- CVSS 6.9 medium
- 0.3% chance of exploitation in the next 30 days (EPSS)