CVE-2026-86670
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In aircheng-org iWebShop-5 up to 5.15, a vulnerability exists in controllers/admin.php of the Authentication Storage component. Manipulating the Password argument leads to a password hash with insufficient computational effort. The attack can be launched remotely but has high complexity and is difficult to exploit. The exploit has been published. The project was informed but has not responded.
Risk Assessment
The risk is that remote attackers may crack user passwords due to weak hashing, potentially leading to unauthorized account access.
Recommendation
Restrict access to the admin panel, monitor logs, and contact the vendor for a patch or consider migrating to an alternative solution.
Other vulnerabilities in iWebShop-5
See all- CVE-2026-86669High
In aircheng-org iWebShop-5 up to 5.15, a vulnerability was detected in the Login function of controllers/systemseller.php. Manipulation of the Name argument results in improper authentication. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed but has not responded.
- CVE-2026-86668Medium
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-86667Medium
A SQL injection vulnerability has been identified in aircheng-org iWebShop-5 up to 5.15, in the member_list function of controllers/member.php, via manipulation of the Search argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The project was informed but has not responded.
- CVE-2026-86666High
A security flaw in aircheng-org iWebShop-5 up to 5.15 in the upload_json/uploadFile function of controllers/pic.php allows unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available. The project was informed but has not responded.
- CVE-2026-86665High
A vulnerability in aircheng-org iWebShop-5 up to 5.15 in the Update::index function of controllers/update.php leads to missing authorization. Remote exploitation is possible, and the exploit is publicly available. The project was informed but has not responded.
Original NVD description (English source)
A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS