CVE-2026-116054 (GCVE-0-2026-116054)
Vulnerability from cvelistv5
Published
2026-10-25 14:15
Modified
2026-10-29 20:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116054",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:08:29.023464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:08:38.135Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:*"
],
"modules": [
"M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o"
],
"product": "SH3",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0x5ea3o1f (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in SH3. This affects an unknown function of the component M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:N/AC:H/Au:M/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "Password Hash With Insufficient Computational Effort",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T14:15:11.104Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426138 | SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426138"
},
{
"name": "VDB-426138 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426138/cti"
},
{
"name": "CVE-2026-116054 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116054"
},
{
"name": "Submit #997072 | SH3 Inform\u00e1tica Ltda M\u00f3dulo de Gest\u00e3o, M\u00f3dulo de Arrecada\u00e7\u00e3o \u003c2026.0.2.0 Storing Passwords in a Recoverable Format",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997072"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:35:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116054",
"datePublished": "2026-10-25T14:15:11.104Z",
"dateReserved": "2026-10-24T21:30:36.601Z",
"dateUpdated": "2026-10-29T20:08:38.135Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-116054\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-29T20:08:29.023464Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-29T20:08:33.862Z\"}}], \"cna\": {\"title\": \"SH3 M\\u00f3dulo de Gest\\u00e3o/M\\u00f3dulo de Arrecada\\u00e7\\u00e3o weak password hash\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"0x5ea3o1f (VulDB User)\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.1, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 2.2, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 2.2, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 1.7, \"vectorString\": \"AV:N/AC:H/Au:M/C:P/I:N/A:N/E:POC/RL:OF/RC:C\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:*\"], \"vendor\": \"n/a\", \"modules\": [\"M\\u00f3dulo de Gest\\u00e3o/M\\u00f3dulo de Arrecada\\u00e7\\u00e3o\"], \"product\": \"SH3\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-24T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-10-24T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-10-24T23:35:43.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/426138\", \"name\": \"VDB-426138 | SH3 M\\u00f3dulo de Gest\\u00e3o/M\\u00f3dulo de Arrecada\\u00e7\\u00e3o weak password hash\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"https://vuldb.com/vuln/426138/cti\", \"name\": \"VDB-426138 | CTI Indicators (IOB, IOC, TTP)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-116054\", \"name\": \"CVE-2026-116054 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/997072\", \"name\": \"Submit #997072 | SH3 Inform\\u00e1tica Ltda M\\u00f3dulo de Gest\\u00e3o, M\\u00f3dulo de Arrecada\\u00e7\\u00e3o \u003c2026.0.2.0 Storing Passwords in a Recoverable Format\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial\", \"tags\": [\"broken-link\", \"exploit\"]}], \"x_generator\": [\"VulDB PVTS v202610\"], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A security vulnerability has been detected in SH3. This affects an unknown function of the component M\\u00f3dulo de Gest\\u00e3o/M\\u00f3dulo de Arrecada\\u00e7\\u00e3o. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-916\", \"description\": \"Password Hash With Insufficient Computational Effort\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-326\", \"description\": \"Inadequate Encryption Strength\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-10-25T14:15:11.104Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-116054\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-29T20:08:38.135Z\", \"dateReserved\": \"2026-10-24T21:30:36.601Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-10-25T14:15:11.104Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…