{"id":"CVE-2026-86668","title":"A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15","summary":"A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-79","CWE-94"],"vendor":"aircheng-org","product":"iWebShop-5","affected":["iWebShop-5 5.0","iWebShop-5 5.1","iWebShop-5 5.2","iWebShop-5 5.3","iWebShop-5 5.4","iWebShop-5 5.5","iWebShop-5 5.6","iWebShop-5 5.7","iWebShop-5 5.8","iWebShop-5 5.9","iWebShop-5 5.10","iWebShop-5 5.11","iWebShop-5 5.12","iWebShop-5 5.13","iWebShop-5 5.14","iWebShop-5 5.15"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T21:17:47.733","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86668","references":[{"url":"https://github.com/aircheng-org/iWebShop-5/","label":"cna@vuldb.com"},{"url":"https://github.com/aircheng-org/iWebShop-5/issues/4","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-86668","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908926","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399759","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399759/cti","label":"cna@vuldb.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-11T20:02:47.173969Z"},"epss":0.00273,"epssPercentile":0.19908,"ingestedAt":"2026-09-08T19:08:49.602Z","slug":"CVE-2026-86668","body":"## Overview\n\nA security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202148,"id":"CVE-2026-86668","ts":1789400063916,"field":"exploit_available","old":"false","new":"true"},{"seq":200875,"id":"CVE-2026-86668","ts":1789397617793,"field":"exploit_available","old":"true","new":"false"},{"seq":199568,"id":"CVE-2026-86668","ts":1789395538507,"field":"exploit_available","old":"false","new":"true"},{"seq":198813,"id":"CVE-2026-86668","ts":1789392245702,"field":"exploit_available","old":"true","new":"false"},{"seq":197146,"id":"CVE-2026-86668","ts":1789384295091,"field":"exploit_available","old":"false","new":"true"},{"seq":196420,"id":"CVE-2026-86668","ts":1789383757380,"field":"exploit_available","old":"true","new":"false"},{"seq":195324,"id":"CVE-2026-86668","ts":1789380575786,"field":"exploit_available","old":"false","new":"true"},{"seq":194275,"id":"CVE-2026-86668","ts":1789378784409,"field":"exploit_available","old":"true","new":"false"},{"seq":193062,"id":"CVE-2026-86668","ts":1789376518958,"field":"exploit_available","old":"false","new":"true"},{"seq":191849,"id":"CVE-2026-86668","ts":1789373632503,"field":"exploit_available","old":"true","new":"false"},{"seq":190634,"id":"CVE-2026-86668","ts":1789369485241,"field":"exploit_available","old":"false","new":"true"},{"seq":189421,"id":"CVE-2026-86668","ts":1789368442131,"field":"exploit_available","old":"true","new":"false"},{"seq":188204,"id":"CVE-2026-86668","ts":1789365234931,"field":"exploit_available","old":"false","new":"true"},{"seq":186991,"id":"CVE-2026-86668","ts":1789363472643,"field":"exploit_available","old":"true","new":"false"},{"seq":185777,"id":"CVE-2026-86668","ts":1789361233563,"field":"exploit_available","old":"false","new":"true"},{"seq":184564,"id":"CVE-2026-86668","ts":1789358365252,"field":"exploit_available","old":"true","new":"false"},{"seq":182814,"id":"CVE-2026-86668","ts":1789354318658,"field":"exploit_available","old":"false","new":"true"},{"seq":181607,"id":"CVE-2026-86668","ts":1789353319091,"field":"exploit_available","old":"true","new":"false"},{"seq":180400,"id":"CVE-2026-86668","ts":1789350286141,"field":"exploit_available","old":"false","new":"true"},{"seq":179193,"id":"CVE-2026-86668","ts":1789348294284,"field":"exploit_available","old":"true","new":"false"},{"seq":177986,"id":"CVE-2026-86668","ts":1789346371963,"field":"exploit_available","old":"false","new":"true"},{"seq":176779,"id":"CVE-2026-86668","ts":1789343185868,"field":"exploit_available","old":"true","new":"false"},{"seq":174896,"id":"CVE-2026-86668","ts":1789334877032,"field":"exploit_available","old":"false","new":"true"},{"seq":173691,"id":"CVE-2026-86668","ts":1789333702170,"field":"exploit_available","old":"true","new":"false"},{"seq":172505,"id":"CVE-2026-86668","ts":1789331094428,"field":"exploit_available","old":"false","new":"true"},{"seq":171319,"id":"CVE-2026-86668","ts":1789328782249,"field":"exploit_available","old":"true","new":"false"},{"seq":170114,"id":"CVE-2026-86668","ts":1789327198515,"field":"exploit_available","old":"false","new":"true"},{"seq":168909,"id":"CVE-2026-86668","ts":1789323841613,"field":"exploit_available","old":"true","new":"false"},{"seq":167704,"id":"CVE-2026-86668","ts":1789319704173,"field":"exploit_available","old":"false","new":"true"},{"seq":166499,"id":"CVE-2026-86668","ts":1789318777538,"field":"exploit_available","old":"true","new":"false"},{"seq":165294,"id":"CVE-2026-86668","ts":1789315805700,"field":"exploit_available","old":"false","new":"true"},{"seq":164089,"id":"CVE-2026-86668","ts":1789313635615,"field":"exploit_available","old":"true","new":"false"},{"seq":162884,"id":"CVE-2026-86668","ts":1789311904873,"field":"exploit_available","old":"false","new":"true"},{"seq":161679,"id":"CVE-2026-86668","ts":1789308734542,"field":"exploit_available","old":"true","new":"false"},{"seq":159792,"id":"CVE-2026-86668","ts":1789300471893,"field":"exploit_available","old":"false","new":"true"},{"seq":158856,"id":"CVE-2026-86668","ts":1789299572171,"field":"exploit_available","old":"true","new":"false"},{"seq":158315,"id":"CVE-2026-86668","ts":1789296693228,"field":"exploit_available","old":"false","new":"true"},{"seq":156781,"id":"CVE-2026-86668","ts":1789294757099,"field":"exploit_available","old":"true","new":"false"},{"seq":155576,"id":"CVE-2026-86668","ts":1789292969289,"field":"exploit_available","old":"false","new":"true"},{"seq":154371,"id":"CVE-2026-86668","ts":1789289798940,"field":"exploit_available","old":"true","new":"false"},{"seq":151622,"id":"CVE-2026-86668","ts":1789277631162,"field":"exploit_available","old":"false","new":"true"},{"seq":150583,"id":"CVE-2026-86668","ts":1789276255445,"field":"exploit_available","old":"true","new":"false"},{"seq":149550,"id":"CVE-2026-86668","ts":1789273826086,"field":"exploit_available","old":"false","new":"true"},{"seq":148517,"id":"CVE-2026-86668","ts":1789271350843,"field":"exploit_available","old":"true","new":"false"},{"seq":146548,"id":"CVE-2026-86668","ts":1789269400546,"field":"exploit_available","old":"false","new":"true"},{"seq":145353,"id":"CVE-2026-86668","ts":1789266341617,"field":"exploit_available","old":"true","new":"false"},{"seq":144257,"id":"CVE-2026-86668","ts":1789262618025,"field":"exploit_available","old":"false","new":"true"},{"seq":143161,"id":"CVE-2026-86668","ts":1789261534819,"field":"exploit_available","old":"true","new":"false"},{"seq":141992,"id":"CVE-2026-86668","ts":1789258836967,"field":"exploit_available","old":"false","new":"true"},{"seq":140833,"id":"CVE-2026-86668","ts":1789256728453,"field":"exploit_available","old":"true","new":"false"}]}