Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96603— Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization

Quick assessment

Affected
Abdurrab5 online-makeup-store
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Abdurrab5 online-makeup-store 中发现了一个漏洞。受影响的组件为“Admin Handler”（管理员处理程序），具体涉及文件 functions.php 中的 confirm_logged_in/confirm_user 函数。通过操纵 adminid 参数，可导致身份验证缺失。该漏洞可由远程攻击者利用。相关攻击方法已公开披露，并可被用于实际攻击。该产品采用滚动发布机制进行持续交付，因此未公开受影响的版本或已更新修复的版本信息。供应商已在早期阶段收到此漏洞的披露通知。

CVSS 7.3 · High EPSS 0.28% · P19

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 3

VendorProduct Version RangeStatus
Abdurrab5 online-makeup-store 336a4b09e5c840bdfe6dfde6616add0b20e4b4ee affected
c3ca96769c008a8a1518c8f9adbc7c8b52d83480 affected
f804fe3ef5cf3570ced0fa34fb2de492a1306345 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96603

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Abdurrab5 online-makeup-store 336a4b09e5c840bdfe6dfde6616add0b20e4b4ee cpe:2.3:a:abdurrab5:online-makeup-store:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-96603

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96603

请登录查看更多情报信息。

News Coverage for CVE-2026-96603 (1)

Same Patch Batch · Abdurrab5 · 2026-09-23 · 3 CVEs total

CVE-2026-96601 7.3 HIGH Abdurrab5 online-makeup-store Admin Login index.php sql injection
CVE-2026-96602 7.3 HIGH Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection

IV. Related Vulnerabilities

Same product: online-makeup-store
Same vendor: Abdurrab5
Same weakness: CWE-862

V. Comments for CVE-2026-96603

No comments yet

Leave a comment