Vulnerability · Published Apr 27, 2026 · Assigned by VulDB

CVE-2026-7103code-projects Chat System MD5 Hash update_user.php weak hash

Low 3.7

In plain English

A low-severity broken cryptography in Chat System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 85.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
code-projects	Chat System	1.0

Weakness: CWE-328, CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-359678 | code-projects Chat System MD5 Hash update_user.php weak hash vdb-entry, technical-description
VDB-359678 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #800384 | code-projects Chat System Using PHP 1.0 nsecure Direct Object Reference (IDOR) + SQL Injection + Weak Pa third-party-advisory
https://gist.github.com/higordiego/84ae7f08f5c23debebf309de3920bda2 related
https://code-projects.org/ product