THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-80211 (MEDIUM 5.9) — FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the for

[NVD] CVE-2026-80211 (MEDIUM 5.9) — FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the for

mednvdPublished 2026-08-27

CVE-2026-80211 CVSS: 5.9 MEDIUM Published: 2026-08-27T17:20:50.733

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc ha

Indicators of compromise

CVE-2026-80211cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-80211