CVE-2026-94413

Summary

The flaw allows authenticated users to retrieve unsalted MD5 password hashes, enabling attackers to perform offline cracking or direct authentication bypass.

Exploitability

Exploitation requires an authenticated user and knowledge of the target's user ID; moderately difficult due to authentication requirement but feasible with minimal effort.

Blast radius

If exploited, it could lead to unauthorized access and potential compromise of all users' accounts on the system.

Prioritized remediation

Update jshERP to the latest version or apply a patch that properly redacts password hashes in responses.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.