CVE-2026-86670: medium-severity vulnerability in aircheng-org iWebShop-5
aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.3epss 0.4%
A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
aircheng-org · iWebShop-5public PoCs found — 1
cve_referencegithub.com/aircheng-org/iWebShop-5/issues/7unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — aircheng-org iWebShop-5
In the same product, most dangerous first.
CVE-2026-86669MEDIUMaircheng-org iWebShop-5 systemseller.php login improper authenticationEPSS 0.7%CVE-2026-86666MEDIUMaircheng-org iWebShop-5 pic.php uploadFile unrestricted uploadEPSS 0.5%CVE-2026-86665MEDIUMaircheng-org iWebShop-5 update.php index authorizationEPSS 0.5%CVE-2026-86668MEDIUMaircheng-org iWebShop-5 pic.php uploadFile cross site scriptingEPSS 0.5%CVE-2026-86667MEDIUMaircheng-org iWebShop-5 member.php member_list sql injectionEPSS 0.3%CVE-2026-112034MEDIUMaircheng-org iWebShop-5 Login Redirect _userInfo.php redirectEPSS 0.3%