CVE-2026-92921: Cjbi ADMIN3

Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days.

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.

Affected products

• Cjbi ADMIN3: up to and including 3.0.0

Published 2026-09-17. Last modified 2026-09-22.