CVE-2026-86669: falha de média gravidade em aircheng-org iWebShop-5
aircheng-org iWebShop-5 systemseller.php login improper authentication
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.7%
A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
aircheng-org · iWebShop-5PoCs públicas encontradas — 1
cve_referencegithub.com/aircheng-org/iWebShop-5/issues/6não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — aircheng-org iWebShop-5
No mesmo produto, das mais perigosas para as menos.
CVE-2026-86666MEDIUMaircheng-org iWebShop-5 pic.php uploadFile unrestricted uploadEPSS 0.5%CVE-2026-86665MEDIUMaircheng-org iWebShop-5 update.php index authorizationEPSS 0.5%CVE-2026-86668MEDIUMaircheng-org iWebShop-5 pic.php uploadFile cross site scriptingEPSS 0.5%CVE-2026-86670MEDIUMaircheng-org iWebShop-5 Authentication Storage admin.php weak password hashEPSS 0.4%CVE-2026-86667MEDIUMaircheng-org iWebShop-5 member.php member_list sql injectionEPSS 0.3%CVE-2026-112034MEDIUMaircheng-org iWebShop-5 Login Redirect _userInfo.php redirectEPSS 0.3%