{"id":"CVE-2026-96552","revision":"df233fc5a4f74fa1a3b8b114fcf9617b","records":[{"revision":"df233fc5a4f74fa1a3b8b114fcf9617b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-96552","aliases":[],"title":"sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt","description":"A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","state":0,"publishedAt":"2026-09-23T20:00:13.847+00:00","modifiedAt":"2026-09-24T15:48:38.87+00:00","affected":[{"ecosystem":"Vendor product","name":"hosp_order","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sfturing\",\n                    \"product\": \"hosp_order\",\n                    \"versions\": [\n                        {\n                            \"version\": \"627f426331da8086ce8fff2017d65b1ddef384f8\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"modules\": [\n                        \"User Password Handler\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","score":2.3,"severity":"LOW"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","score":3.1,"severity":"LOW"},{"system":"CVSS 3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","score":3.1,"severity":"LOW"},{"system":"CVSS 2.0","vector":"AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR","score":2.1,"severity":null}],"references":["https://vuldb.com/vuln/408954","https://vuldb.com/vuln/408954/cti","https://vuldb.com/cve/CVE-2026-96552","https://vuldb.com/submit/907955","https://github.com/sfturing/hosp_order/issues/123","https://github.com/sfturing/hosp_order/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96552","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96552","identifiers":["CVE-2026-96552"]},"retained":false,"historicalAffected":[]}],"coverage":[]}