CVE / Vulnerability Disclosures

Publicly disclosed vulnerabilities I’ve reported, coordinated with vendors under responsible disclosure. Each entry links to the official CVE record on cve.org and the VulDB advisory. The VulDB entries credit reporter handle yunshen — see About → Platform Handles for the verification linking that handle to me.

• CVE-2026-86665 aircheng-org iWebShop-5 up to 5.15 Missing Authorization (CWE-862) · Vendor advisory
  CVSS 7.3 2026-09-08
• CVE-2026-86666 aircheng-org iWebShop-5 up to 5.15 Unrestricted Upload (CWE-434) · Vendor advisory
  CVSS 7.3 2026-09-08
• CVE-2026-86667 aircheng-org iWebShop-5 up to 5.15 SQL Injection (CWE-89) · Vendor advisory
  CVSS 4.7 2026-09-08