code-projects Chat System 1.0 contains a flaw in update_user.php where the password argument is hashed with the outdated MD5 algorithm. The CWE-327 and CWE-328 weaknesses allow an attacker to preprocess or brute‑force the hash, potentially revealing user passwords. Because the flaw resides in the authentication component, compromised passwords could lead to unauthorized account access.

Affected product is the code-projects Chat System, specifically version 1.0. The vulnerability is tied to the MD5 Hash Handler in the update_user.php file. No other versions or upstream products are explicitly listed, so only this version is confirmed to be vulnerable.

CVSS score 6.3 indicates a moderate risk. EPSS <1% shows that public exploitation is unlikely, and the vulnerability is not in the CISA KEV catalog. The attack vector is remote, with a high complexity and difficult exploitability as stated, but the public disclosure means the threat is still present. Organizations running the vulnerable version should treat this as a medium‑severity threat until a proper cryptographic solution is in place.