iWebShop-5 EUVD-2026-104028

Exploitation targets the send_message_mobile function in controllers/simple.php and requires the attacker to control the user_id argument to abuse the weak password-recovery (CWE-640) logic; it is reachable remotely over the network against iWebShop-5 versions up to and including 5.16. The supplied vector lists PR:L, implying some prior privilege/session may be needed, though this is inconsistent with typical pre-authentication password-recovery abuse and is not independently confirmed. Limiting factors: no public fix or patch is available (upstream unresponsive), impact is low per the CVSS vector, and the product's small deployment base constrains the realistic attack surface; no user interaction is required (UI:N).

This is a moderate, low-priority issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw with low impact across all three dimensions (VC:L/VI:L/VA:L), and the input assigns a base score of 5.3 (Medium). The E:P temporal metric confirms only a proof-of-concept, not weaponized exploitation. Exploitation status: publicly available exploit code exists (a GitHub issue report), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of real-world or widespread exploitation - the signal is consistent with a disclosed-but-not-actively-exploited bug. Note a conflict worth flagging: the CVSS vector specifies PR:L (authenticated), yet a password-recovery weakness (CWE-640) is typically abused by an UNauthenticated attacker who does not yet possess credentials - verify the privilege requirement with the vendor, as it materially affects real risk. The combination of low impact, a niche open-source product, PoC-only maturity, and an unresponsive upstream project points to a real but low-severity issue, not a high-priority emergency.

A remote attacker invokes the send_message_mobile function in controllers/simple.php and manipulates the user_id argument to abuse the weak password-recovery mechanism, potentially triggering or redirecting recovery messages for another account. Public proof-of-concept detail exists in the upstream GitHub issue, lowering the bar to reproduce. Because CVSS rates attack complexity low (AC:L) and the vector as network (AV:N), the request can be sent directly against an exposed iWebShop instance.