CVE-2026-86665: aircheng-org iWebShop-5 update.php index authorization
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
aircheng-org iWebShop-5 versions up to and including 5.15 are affected. The issue is in the Update::index function in controllers/update.php.
Can this be exploited remotely without credentials or user interaction?
Yes. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
Is exploit code available?
Yes. A public exploit is available and may be used by attackers.
What is the likely impact of successful exploitation?
The issue is missing authorization and is rated high with a 7.3 CVSS score. The provided vector indicates low impact to confidentiality, integrity, and availability.
Is a vendor fix confirmed?
No fix is identified in the provided information. The project was notified through an issue report but had not responded at the time of publication.