Damn, this was my first Security Focus hit. I had a missing Privilige Check in one file of holaCMS which lead to a remote user be able to see the encrypted password.
The fix was easy and quick, but this was my first public security hole ever ;)
comrad