Weak Cryptographic Algorithm Vulnerability in QloApps by QloApps

CVE-2026-25861

What is CVE-2026-25861?

QloApps versions prior to 1.7.0 utilize a weak cryptographic algorithm for password hashing. The reliance on MD5 within the Tools::encrypt() function compromises user credential security. This vulnerability allows attackers to conduct offline brute-force attacks against user passwords. The situation is further aggravated by the use of auto-generated 8-character passwords for guest-to-customer account creation, making the recovery of credentials alarmingly simple. It is imperative for users to upgrade to the patched version to safeguard their accounts from potential exploitation.

References