Product
CVE-2026-86666 allows remote, unauthenticated attackers to perform arbitrary file uploads via the uploadFile function in iWebShop-5 versions up to 5.15.