Live › vulnerability › CVE-2026-112035
Go to dashboardiWebShop 5 up to 5.16 has a flaw in the send_message_mobile function of controllers/simple.php, where the user_id argument is manipulated to abuse password recovery. A remote attacker can exploit it, and the exploit has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running iWebShop 5 up to 5.16 that expose the mobile password recovery endpoint to the internet are exposed. Installations on newer versions, or with that endpoint blocked, are not described as affected.
No product ranges from the sources yet.
5.16 or older.controllers/simple.php for the send_message_mobile function and check whether the user_id argument is used unchecked.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112035")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.