Low
aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
Type: advisorySources: OSV
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-86668
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 16:13 UTC · Revision 1
Source evidence
aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
core-osv · Original sourcePublished 8 Sept 2026, 16:45 UTC
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
osv:CVE-2026-86668
Complete source record
{
"id": "5452de4a4f3f35ad102550f8e10df1939293c7a4d79231d80b6a5b28d9443ace",
"url": "https://osv.dev/vulnerability/CVE-2026-86668",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "aircheng-org iWebShop-5 pic.php uploadFile cross site scripting",
"summary": "A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"evidence": "osv:CVE-2026-86668",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-86668",
"aliases": [
"CVE-2026-86668"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/aircheng-org/iwebshop-5",
"type": "GIT",
"events": [
{
"introduced": "265c1cf536fc17cce6c70ae9c26992b516ba8a30"
},
{
"last_affected": "3bdd7ce934d6d253b59a7131b6fe930af7f77382"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "5.11"
},
{
"last_affected": "5.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.12"
},
{
"last_affected": "5.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.13"
},
{
"last_affected": "5.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.14"
},
{
"last_affected": "5.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.15"
},
{
"last_affected": "5.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5"
},
{
"last_affected": "5.15"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"5.11",
"5.12",
"5.13",
"5.14",
"5.15",
"v5.15",
"v5.14",
"v5.13",
"v5.12",
"v5.11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86668.json"
}
}
],
"modified": "2026-10-28T02:30:30.471100388Z",
"provider": "osv",
"references": [
"https://github.com/aircheng-org/iWebShop-5/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86668.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-86668",
"https://vuldb.com/cve/CVE-2026-86668",
"https://vuldb.com/submit/908926",
"https://vuldb.com/vuln/399759",
"https://github.com/aircheng-org/iWebShop-5/issues/4",
"https://vuldb.com/vuln/399759/cti"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79",
"CWE-94"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "5.0"
},
{
"last_affected": "5.0"
},
{
"introduced": "5.1"
},
{
"last_affected": "5.1"
},
{
"introduced": "5.2"
},
{
"last_affected": "5.2"
},
{
"introduced": "5.3"
},
{
"last_affected": "5.3"
},
{
"introduced": "5.4"
},
{
"last_affected": "5.4"
},
{
"introduced": "5.5"
},
{
"last_affected": "5.5"
},
{
"introduced": "5.6"
},
{
"last_affected": "5.6"
},
{
"introduced": "5.7"
},
{
"last_affected": "5.7"
},
{
"introduced": "5.8"
},
{
"last_affected": "5.8"
},
{
"introduced": "5.9"
},
{
"last_affected": "5.9"
},
{
"introduced": "5.10"
},
{
"last_affected": "5.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86668.json"
}
},
"related_cves": [
{
"value": "CVE-2026-86668",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497201,
"published_at": "2026-09-08T16:45:07.924+00:00"
}