CVE-2026-112035 Details
Description
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability in aircheng-org iWebShop-5, affecting versions up to 5.16, allows for weak password recovery. The issue arises in the 'send_message_mobile' function within 'controllers/simple.php', where manipulation of the 'user_id' argument can be exploited. This vulnerability enables remote attacks, as the reset codes are five-digit integers that can be brute-forced. The project has been notified of this issue but has not yet responded.
The password reset process should be modified to use a cryptographically secure token of at least 128 bits, store only a hash of the token, and implement a system where tokens expire within minutes, are single-use and deleted upon successful use, and are subject to strict rate limits per account or IP address.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aircheng-org/iWebShop-5/issues/11 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/aircheng-org/iWebShop-5/ | [email protected] | ProductVendor |
| https://github.com/aircheng-org/iWebShop-5/issues/11 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112035 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008390 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421683 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421683/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| aircheng-org iWebShop-5 | <= 5.16 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |