CVE-2026-112033CWE-352CWE-862broken-access-controlcsrf

CVE-2026-112033

Medium · published October 19, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00159 · 4.6th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2026-10-19T05:16Z
References (6)
https://github.com/aircheng-org/iWebShop-5/ · [email protected]https://github.com/aircheng-org/iWebShop-5/issues/9 · [email protected]https://vuldb.com/cve/CVE-2026-112033 · [email protected]https://vuldb.com/submit/1008388 · [email protected]https://vuldb.com/vuln/421681 · [email protected]https://vuldb.com/vuln/421681/cti · [email protected]
EPSS history
Timeline
  • 20 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 19 OCT 00:00Z
    aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery
    cvelistv5
  • 19 OCT 00:00Z
    aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery
    cvelistv5