---
id: "CVE-2026-112033"
kind: "vulnerability"
aliases: ["CVE-2026-112033"]
title: "iWebShop-5: password change form accepts cross-site forged requests"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["e-commerce", "iwebshop", "other", "php", "self-hosted"]
not_affected_if: ["newer-version", "no-admin-login-in-browser"]
published_at: "2026-10-19T01:16:36+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:30:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112033", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# iWebShop-5: password change form accepts cross-site forged requests

The admin password change function in iWebShop-5 up to version 5.16 does not protect against cross-site request forgery. A malicious web page can make a logged-in administrator's browser submit a password change.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed iWebShop-5 version; the sources say versions up to 5.16 are affected.
- Look at controllers/system.php for the admin_repwd and admin_repwd_act functions and whether they verify a CSRF token.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112033

## From the sources

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_