Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.0
CVE-2026-112032: iWebShop-5 search function allows remote database tampering
CVE-2026-112032 · published today
Summary
The search feature in iWebShop-5 versions up to 5.16 can be tricked into running unintended database commands, letting attackers read, change, or delete data. This can be done over the internet without any special access, and tools to exploit it are already publicly available. Apply the vendor's update or patch the affected file to stop the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| aircheng-org | iwebshop-5 | 5.0 |
Original advisory text
aircheng-org iWebShop-5 util.php search sql injection
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
2.0
Low
Type
CWE-89SQL Injection
CWE-74Injection
Timeline
Published19 Oct 2026
Updated19 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta