Live › vulnerability › CVE-2026-112033
Go to dashboardThe admin password change function in iWebShop-5 up to version 5.16 does not protect against cross-site request forgery. A malicious web page can make a logged-in administrator's browser submit a password change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running iWebShop-5 up to 5.16 with an admin account that can be reached in a browser. The sources do not say whether a patch exists; the project has not responded to the report.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112033")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.