Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 8, 2026 · NIST NVD

   Detected

   Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.

2. Oct 14, 2026 · NIST NVD

   Updated

   Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.

Sources

• CVE.orgVulnerability recordCVE-2026-107829

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-107829

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-107829

  Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed table

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · vulncheck.com