CVE-2026-112035: aircheng-org iWebShop-5 simple.php send_message_mobile password recovery
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function sendmessagemobile of the file controllers/simple.php. Such manipulation of the argument userid leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker can launch the attack remotely, but the vector indicates low privileges are required. No user interaction is needed.
Which deployments are affected?
The affected component is iWebShop-5 through version 5.16, specifically the send_message_mobile function in controllers/simple.php. The provided data does not state whether any particular installation or password-recovery configuration is unaffected.
What is the practical impact?
Manipulation of the user_id argument can weaken password recovery. The supplied scoring indicates potential low-impact compromise of confidentiality, integrity, and availability.
How urgent is remediation?
The vulnerability has a medium base severity of 6.3, and a public exploit has been disclosed. The project was notified through an issue report but had not responded at the time of the provided information.