CVE-2026-86666
HighCVSS 7.3Summary
A security flaw in aircheng-org iWebShop-5 up to 5.15 in the upload_json/uploadFile function of controllers/pic.php allows unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available. The project was informed but has not responded.
Risk Assessment
An attacker can upload malicious files to the server, potentially leading to full compromise of the application or server. The public exploit increases the risk of active exploitation.
Recommendation
Immediately restrict access to the file upload functionality, implement file type validation, and consider disabling or patching the vulnerable component. Monitor for updates and upgrade the software.
Other vulnerabilities in iWebShop-5
See all- CVE-2026-86668Medium
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-86667Medium
A SQL injection vulnerability has been identified in aircheng-org iWebShop-5 up to 5.15, in the member_list function of controllers/member.php, via manipulation of the Search argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The project was informed but has not responded.
- CVE-2026-86665High
A vulnerability in aircheng-org iWebShop-5 up to 5.15 in the Update::index function of controllers/update.php leads to missing authorization. Remote exploitation is possible, and the exploit is publicly available. The project was informed but has not responded.
Original NVD description (English source)
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.