&quot;See you have a vulnerability there, and then I can get access to this, and then this, and see now I have the password of your user&quot;<p>However, these weak passwords could have been exploited separately as part of an attack.  It is fair to call it a new vulnerability, even though it was discovered by exploiting the first vulnerability.