Vulnerable to CVE-2026-6433 (SQLi confirmed) but webshell upload failed