Nixpkgs security tracker
5.5 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Exploit Maturity (E): POC (P)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
Activity log
- Created suggestion
chiuwingyan house selectall.action sql injection
A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
References
-
-
-
CVE-2026-19062 | CVE Analysis and Report third-party-advisory
-
Submit #864345 | GitHub house V1.0 SQL Injection third-party-advisory
Affected products
- ==dea6bcceaebe2b364a5a209747f48ecc2b2dc670
Matching in nixpkgs
pkgs.warehouse
Manage all things Flatpak
pkgs.clickhouse
Column-oriented database management system
-
nixos-unstable 26.5.2.39-stable
- nixpkgs-unstable 26.6.1.1193-stable
- nixos-unstable-small 26.7.1.1315-stable
-
nixos-26.05 26.5.1.882-stable
- nixos-26.05-small 26.5.1.882-stable
- nixpkgs-26.05-darwin 26.5.1.882-stable
pkgs.lighthouse
Ethereum consensus client in Rust
pkgs.clickhouse-cli
Third-party client for the Clickhouse DBMS server
pkgs.clickhouse-cpp
C++ client library for ClickHouse
-
nixos-unstable -
- nixos-unstable-small 2.6.2
pkgs.clickhouse-lts
Column-oriented database management system
-
nixos-unstable 26.3.12.3-lts
- nixpkgs-unstable 26.3.17.4-lts
- nixos-unstable-small 26.3.17.56-lts
-
nixos-26.05 26.3.10.62-lts
- nixos-26.05-small 26.3.10.62-lts
- nixpkgs-26.05-darwin 26.3.10.62-lts
pkgs.agent-safehouse
Sandbox your local AI agents so they can read/write only what they need
-
nixos-unstable -
- nixos-unstable-small 0.11.0
pkgs.clickhouse-backup
Tool for easy ClickHouse backup and restore using object storage for backup files
pkgs.google-lighthouse
Automated auditing, performance metrics, and best practices for the web
pkgs.lighthouse-steamvr
VR Lighthouse power state management
pkgs.nebula-lighthouse-service
Public Nebula VPN Lighthouse Service
pkgs.haskellPackages.network-house
data and parsers for Ethernet, TCP, UDP, IPv4, IPv6, ICMP, DHCP, TFTP
pkgs.python313Packages.housekeeping
Reusable deprecation helpers for Python projects
pkgs.python314Packages.housekeeping
Reusable deprecation helpers for Python projects
pkgs.python313Packages.clickhouse-cli
Third-party client for the Clickhouse DBMS server
pkgs.python314Packages.clickhouse-cli
Third-party client for the Clickhouse DBMS server
pkgs.python313Packages.clickhouse-driver
Python driver with native interface for ClickHouse
pkgs.python314Packages.clickhouse-driver
Python driver with native interface for ClickHouse
pkgs.python313Packages.clickhouse-connect
ClickHouse Database Core Driver for Python, Pandas, and Superset
pkgs.python314Packages.clickhouse-connect
ClickHouse Database Core Driver for Python, Pandas, and Superset
pkgs.python313Packages.clickhouse-cityhash
Python-bindings for CityHash, a fast non-cryptographic hash algorithm
pkgs.python314Packages.clickhouse-cityhash
Python-bindings for CityHash, a fast non-cryptographic hash algorithm
pkgs.grafanaPlugins.grafana-clickhouse-datasource
Connects Grafana to ClickHouse
pkgs.python313Packages.aliyun-python-sdk-clickhouse
Module of Aliyun Python SDK (clickhouse)
pkgs.python314Packages.aliyun-python-sdk-clickhouse
Module of Aliyun Python SDK (clickhouse)
Package maintainers
-
@thevar1able Konstantin Bogdanov <var1able+nixpkgs@var1able.network>
-
@devusb Morgan Helton <mhelton@devusb.us>
-
@bobrik Ivan Babrou <nixpkgs@ivan.computer>
-
@theCapypara Marco Köpcke <hello@capypara.de>
-
@majiru Jacob Moody <moody@posixcafe.org>
-
@centromere Alex Wied <nix@centromere.net>
-
@philipmw Philip White <philip@mailworks.org>
-
@bddvlpr Luna Simons <luna@bddvlpr.com>
-
@bloominstrong bloominstrong <github@mail.bloominstrong.net>
-
@breakds Break Yang <breakds@gmail.com>
-
@cpcloud Phillip Cloud
-
@michaelgrahamevans Michael Evans <michaelgrahamevans@gmail.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@Myzel394 Myzel394 <github.7a2op@simplelogin.co>
-
@Br1ght0ne Oleksii Filonenko <nixpkgs@brightone.cloud>
-
@jlesquembre José Luis Lafuente <jl@lafuente.me>