CVE-2026-41879
Weak password hashing in R-SOFT DMS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue was fixed in version v3.17-2000.
| CWE | CWE-328 |
| Vendor | r-soft serwis |
| Product | dms |
| Published | Jul 10, 2026 |
| Last Updated | Jul 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for r-soft serwis dms
Be the first to know when new unknown vulnerabilities affecting r-soft serwis dms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
R-SOFT SERWIS / DMS
0 < v3.17-2000
Credits
Marek Figielski (Vanilla.pl)