Is CVE-2026-110104 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110104?

CVE-2026-110104 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-110104

Description

Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.