Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-112033: iWebShop-5 password change can be hijacked remotely
CVE-2026-112033 · published today
Summary
The password change page in iWebShop-5 (up to version 5.16) can be tricked into changing an administrator's password without their knowledge. An attacker could send a crafted request that makes the system accept a new password, potentially taking control of the admin account. Apply the vendor's patch or restrict access to the password change function until an update is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| aircheng-org | iwebshop-5 | 5.0 |
Original advisory text
aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
2.1
Low
Type
CWE-352Cross-Site Request Forgery (CSRF)
CWE-862Missing Authorization
Timeline
Published19 Oct 2026
Updated19 Oct 2026
First seen19 Oct 2026
Track software like this
Free during beta