The question asks if this paper, and in particular it's table 3 (the second image in the question, more readable here) shows a cryptographic weakness of SHA-256.
No, it does not.
The table tells that the SHA-256 hash of password
, 123456789
, 111111
, qwerty
, and dragon
are identified as such by Crackstation, Cmd5, and Hashcat; but the (different) hash of these strings by a different hash is not identified by these tools.
That does not prove anything negative about SHA-256 (and nothing in the title, abstract or figure of the article suggests the contrary). That at best illustrates the known fact it's not a good idea to hash a password with a standard fast hash and make the result public.
The article also tries to assess the cryptographic quality of a modification of SHA-256 by running standard statistical tests. At best, this could demonstrate a weakness, if the tests consistently failed. They do not. Thus nothing (beyond passing the test) is demonstrated.
The article is good at two things: it proves that being published in the ACM International Conference Proceeding Series is not a sure sign of being of interest. And that the same authors can get two papers on the same dull subject published in that series within a period of 3 months, see this earlier paper.