This vulnerability arises from the use of a one‑way hash function without a salt in Pik Online Portal, enabling cryptanalysis that can potentially expose sensitive data. The flaw allows an attacker to obtain hash values that can be subjected to offline dictionary or brute‑force attacks to reveal plaintext information, such as user credentials, compromising confidentiality. The weakness is categorized as CWE‑759, which addresses lack of salt in cryptographic hashing.

Pik Online Software Solutions Inc. – Pik Online Portal. Affected releases include all versions up to and including 3.5.1; later releases are not listed as affected.

The CVSS score of 6.3 indicates moderate overall risk. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation. The attack vector is not explicitly disclosed, but due to the lack of salt, an adversary who can obtain any hash value could perform offline attacks to recover the original data. If the compromised hash is a password or other sensitive token, successful exploitation could lead to unauthorized access or data breach. The exploitability is therefore considered moderate with a realistic threat if the hash values are exposed or transmitted insecurely.