What’s Vulnerable › Vulnerabilities

CVE-2023-40173: Unsalted passwords in fobybus/social-media-skeleton

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-18 · updated 2026-06-17
• Weakness: CWE-522

Description

Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• fobybus social-media-skeleton: before 1.0.5 — fixed in 1.0.5

How to fix

Upgrade to a fixed version: fobybus social-media-skeleton 1.0.5. Check the vendor advisory for mitigations.

References

• https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848
• https://github.com/fobybus/social-media-skeleton/commit/df31da44ffed3ea065cbbadc3c8052d0d489a2ef
• https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-rfmv-7m7g-v628
• https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848
• https://github.com/fobybus/social-media-skeleton/commit/df31da44ffed3ea065cbbadc3c8052d0d489a2ef
• https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-rfmv-7m7g-v628

Get alerted when CVE-2023-40173 or the next vulnerability affects your stack