CVE-2026-86668 Details
Description
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A cross-site scripting (XSS) vulnerability has been identified in aircheng-org iWebShop-5 versions through 5.15. The issue arises in the uploadFile function within the file controllers/pic.php. The vulnerability is triggered by manipulating the outerSrc or selectPhoto arguments, allowing for the injection of malicious scripts. This reflected XSS can be exploited remotely, and the vulnerability has been publicly disclosed.
It is recommended to authenticate the endpoint, avoid reflecting user inputs directly into JavaScript, and instead return JSON responses that can be safely handled by the client. Additionally, apply context-aware JavaScript encoding to sanitize any user-generated content.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aircheng-org/iWebShop-5/ | [email protected] | ProductSource CodeVendor |
| https://github.com/aircheng-org/iWebShop-5/issues/4 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-86668 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/908926 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399759 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399759/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| aircheng-org iWebShop-5 | <= 5.15 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |