CVE-2026-112034CWE-601

CVE-2026-112034

Medium · published October 19, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00348 · 27.3th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-10-19T05:16Z
References (6)
https://github.com/aircheng-org/iWebShop-5/ · [email protected]https://github.com/aircheng-org/iWebShop-5/issues/10 · [email protected]https://vuldb.com/cve/CVE-2026-112034 · [email protected]https://vuldb.com/submit/1008389 · [email protected]https://vuldb.com/vuln/421682 · [email protected]https://vuldb.com/vuln/421682/cti · [email protected]
EPSS history
Timeline
  • 19 OCT 00:15Z
    aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
    cvelistv5
  • 19 OCT 00:15Z
    aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
    cvelistv5