Live › vulnerability › CVE-2026-112032
Go to dashboardiWebShop-5 up to version 5.16 has an SQL injection flaw in the Util::search function in classes/util.php. A remote attacker can alter database queries through crafted input, which can expose or change stored shop data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running iWebShop-5 at version 5.16 or earlier are exposed through the search path in classes/util.php. The sources do not say whether specific configurations change exposure. The project has not responded to the early report, so no patched version is confirmed.
No product ranges from the sources yet.
5.16 or earlier.classes/util.php for the Util::search function and check whether user input is concatenated into SQL without parameter binding.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112032")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.