Filtered by vendor Newbee-ltd Subscriptions
Filtered by product Newbee-mall Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-26218 1 Newbee-ltd 1 Newbee-mall 2026-02-14 9.8 Critical
newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.
CVE-2026-26219 1 Newbee-ltd 1 Newbee-mall 2026-02-14 9.1 Critical
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.