CVE-2026-86670

Summary

A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the component Authentication Storage. Executing a manipulation of the argument Password can lead to password hash with insufficient computational effort. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected Software

VendorProductVersion RangeStatus
aircheng-orgiWebShop-55.0affected
aircheng-orgiWebShop-55.1affected
aircheng-orgiWebShop-55.2affected
aircheng-orgiWebShop-55.3affected
aircheng-orgiWebShop-55.4affected
aircheng-orgiWebShop-55.5affected
aircheng-orgiWebShop-55.6affected
aircheng-orgiWebShop-55.7affected
aircheng-orgiWebShop-55.8affected
aircheng-orgiWebShop-55.9affected
aircheng-orgiWebShop-55.10affected
aircheng-orgiWebShop-55.11affected
aircheng-orgiWebShop-55.12affected
aircheng-orgiWebShop-55.13affected
aircheng-orgiWebShop-55.14affected
aircheng-orgiWebShop-55.15affected

Weaknesses

  • CWE-916: Password Hash With Insufficient Computational Effort
  • CWE-326: Inadequate Encryption Strength

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References