MD5 was intended to be a cryptographic hash function, and one of the useful properties for such a function is its collision-resistance. Ideally, it should take work comparable to around $2^{64}$ tries (as the output size is $128$ bits, i.e. there are $2^{128}$ different possible values) to find a collision (two different inputs hashing to the same output). (Actually, brute-forcing this is today almost in the range of possible, so this alone would be a reason not to use any small-output hash function like MD5.)

It showed that MD5 is not that resistant as intended, and nowadays it is relatively easy to produce more collisions, even with an arbitrary common prefix and suffix.

There was a spectacular example, when someone used an MD5 collision to get a fake SSL certificate from a certification agency. The agency signed a certificate for a domain which belonged to the attacker, and the attacker produced a different certificate (for another domain) with the same hash, i.e. for which the same signature was valid.

Don't use MD5 for any application which relies on collision-resistance (like signatures) ... or for any new application at all. Use SHA-2 now.

MD5 was intended to be a cryptographic hash function, and one of the useful properties for such a function is its collision-resistance. Ideally, it should take work comparable to around $2^{64}$ tries (as the output size is $128$ bits, i.e. there are $2^{128}$ different possible values) to find a collision (two different inputs hashing to the same output). (Actually, brute-forcing this is today almost in the range of possible, so this alone would be a reason not to use any small-output hash function like MD5.)

It showed that MD5 is not that resistant as intended, and nowadays it is relatively easy to produce more collisions, even with an arbitrary common prefix and suffix.

There was a spectacular example, when someone used an MD5 collision to get a fake SSL certificate from a certification agency. The agency signed a certificate for a domain which belonged to the attacker, and the attacker produced a different certificate (for another domain) with the same hash, i.e. for which the same signature was valid.

Don't use MD5 for any application which relies on collision-resistance (like signatures) ... or for any new application at all. Use SHA-2 (or SHA-3) now.