CWE-916— Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.— MITRE CWE catalog
158 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-916page 4 of 4
- CVE-2022-31177LOWCVSS 2.7EG 2.72022-08-01
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters cou…
- CVE-2026-112029LOWCVSS 2.5EG 2.52026-10-18
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to pas…
- CVE-2023-4986LOWCVSS 2.5EG 2.52023-09-15
A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the file Project.xml. The manipulation leads to password hash with insufficient compu…
- CVE-2026-49005LOWCVSS 2.4EG 2.42026-08-07
The root password hash of the device can be obtained through unencrypted information in the firmware.
- CVE-2026-116054LOWCVSS 2.2EG 2.22026-10-25
A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is…
- CVE-2009-4269LOWCVSS v2 2.1EG 2.12010-08-16
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that mak…
- CVE-2024-21754LOWCVSS 1.8EG 1.82024-06-11
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions,…
- CVE-2024-2365LOWCVSS 1.6EG 1.62024-03-11
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component S…
Map vulnerabilities like CWE-916 to your infrastructure
EchelonGraph correlates every CVE — across CWE-916 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →