CVE-2026-112033 | aircheng-org iWebShop-5 up to 5.16 Password Change controllers/system.php admin_repwd/admin_repwd_act password/repassword cross-site request forgery

October 18, 2026 Yanac

A vulnerability classified as problematic was found in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery.

This vulnerability is known as CVE-2026-112033. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More