newbee-mall stores user passwords using an unsalted MD5 hash without per-user salts or computational cost controls. This weakness, classified as CWE‑327, allows an attacker who obtains password hashes—through database breach, backup leakage, or other compromise—to perform rapid offline brute‑force attacks and recover plaintext credentials. The result is unauthorized system access and potential lateral movement within the affected environment.

All installations of newbee‑ltd newbee‑mall, including the v1.0.0 release as specified by the CPE identifiers. No specific version patch is listed, indicating the problem persists across at least the versions enumerated.

The CVSS base score of 9.3 marks the vulnerability as critical, while the EPSS score of less than 1 % suggests a low probability of exploitation at present. The vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. Likely attack vectors include any scenario where an attacker can access the password hash database, such as data exfiltration during a breach or exposure of encrypted backups. Once obtained, the hashes can be cracked offline, granting immediate credential compromise.