Is CVE-2026-25861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25861 being exploited in the wild.

How severe is CVE-2026-25861?

Medium severity, with a CVSS score of 5.9, published 2 June 2026.

Is there a fix for CVE-2026-25861?

A patch was published on 2026-05-19: Fix merged into develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25861 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-25861?

Check whether you run QloApps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25861: QloApps weak password hashing in Tools.php

CVE-2026-25861 · Severity: medium · CVSS 5.9 · Published 2026-06-02

QloApps, an open-source hotel booking and reservation system, uses an outdated and weak method for securing user passwords. This flaw allows attackers who obtain the database to easily crack user passwords through automated guessing, potentially leading to unauthorized access to customer accounts and sensitive personal information. The risk is particularly high for accounts converted from guest status, which are assigned short, predictable passwords.

Technologies: QloApps. Vendors: QloApps.

Quick answers

Is CVE-2026-25861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25861 being exploited in the wild.
How severe is CVE-2026-25861?: Medium severity, with a CVSS score of 5.9, published 2 June 2026.
Which products and versions are affected?: QloApps through 1.7.0.
Is there a fix for CVE-2026-25861?: A patch was published on 2026-05-19: Fix merged into develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25861 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25861?: Check whether you run QloApps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

QloApps through version 1.7.0 utilizes the MD5 hashing algorithm within the Tools::encrypt() function in classes/Tools.php to secure user passwords. The implementation concatenates a static cookie key with the password before hashing, which does not provide sufficient protection against modern offline brute-force attacks. Furthermore, the classes/Customer.php component auto-generates weak 8-character passwords during guest-to-customer account conversions, significantly reducing the entropy required for successful credential recovery. An attacker with access to the hashed credentials can trivially recover plaintext passwords. The issue was addressed in commit 64e9722 by migrating the hashing mechanism to bcrypt.

Affected products

QloApps QloApps through 1.7.0

Timeline

2026-03-13: other: Pull request initiated
2026-05-19: patched: Fix merged into develop branch
2026-06-02: disclosed: Vulnerability details published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.