---
id: CVE-2026-112034
title: aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
summary: >-
  A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The
  impacted element is the function IController::redirect of the file
  plugins/_userInfo/_userInfo.php of the component Login Redirect. This
  manipulation of the argume…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-601
vendor: aircheng-org
product: iWebShop-5
affected:
  - iWebShop-5 5.0
  - iWebShop-5 5.1
  - iWebShop-5 5.2
  - iWebShop-5 5.3
  - iWebShop-5 5.4
  - iWebShop-5 5.5
  - iWebShop-5 5.6
  - iWebShop-5 5.7
  - iWebShop-5 5.8
  - iWebShop-5 5.9
  - iWebShop-5 5.10
  - iWebShop-5 5.11
  - iWebShop-5 5.12
  - iWebShop-5 5.13
  - iWebShop-5 5.14
  - iWebShop-5 5.15
  - iWebShop-5 5.16
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T00:15:19.433Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112034'
references:
  - url: 'https://vuldb.com/vuln/421682'
    label: VDB-421682 | aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
  - url: 'https://vuldb.com/vuln/421682/cti'
    label: 'VDB-421682 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112034'
    label: CVE-2026-112034 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1008389'
    label: >-
      Submit #1008389 | aircheng-org iWebShop-5
      eb7f7eb1c6ebf39a54f943d8e0aefe96a3b8ff54 Open Redirect
  - url: 'https://github.com/aircheng-org/iWebShop-5/issues/10'
  - url: 'https://github.com/aircheng-org/iWebShop-5/'
tags:
  - cve.org
ingestedAt: '2026-10-19T01:55:59.835Z'
---

## Overview

A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `iWebShop-5 5.0`
- `iWebShop-5 5.1`
- `iWebShop-5 5.2`
- `iWebShop-5 5.3`
- `iWebShop-5 5.4`
- `iWebShop-5 5.5`
- `iWebShop-5 5.6`
- `iWebShop-5 5.7`
- `iWebShop-5 5.8`
- `iWebShop-5 5.9`
- `iWebShop-5 5.10`
- `iWebShop-5 5.11`
- `iWebShop-5 5.12`
- `iWebShop-5 5.13`
- `iWebShop-5 5.14`
- `iWebShop-5 5.15`
- `iWebShop-5 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.