Is there a public PoC exploit available for EUVD-2026-72920?

Yes, a public proof-of-concept exploit is available for EUVD-2026-72920. Prioritise patching immediately. EPSS: 0.2%.

iWebShop-5 EUVD-2026-72920

Q: What is the CVSS score of EUVD-2026-72920?

EUVD-2026-72920 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-86667 LOW

SQL Injection (CWE-89)

2026-09-08 VulDB

GHSA-6p7q-grjc-pvgw

PHP SQLi Iwebshop 5

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

High privilege required per CVSS 4.0 PR:H; network-reachable admin endpoint; all impacts low per VC:L/VI:L/VA:L in source vector.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Sep 08, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Sep 08, 2026 - 17:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Sep 08, 2026 - 17:16 vuln.today

CVE Published

Sep 08, 2026 - 16:30 cve.org

MEDIUM 5.1

DescriptionCVE.org

A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	High-privilege authenticated access to the iWebShop-5 administrative interface is required - the CVSS 4.0 vector confirms PR:H. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score is 5.1, reflecting the PR:H (high privilege required) constraint, which significantly limits exploitability compared to an unauthenticated SQLi. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the disclosure filed at https://github.com/aircheng-org/iWebShop-5/issues/5. … Detailed patch versions, workarounds, and compensating controls in full report.