CVE-2026-19062 describes a SQL injection vulnerability in the chiuwingyan house software up to commit dea6bcceaebe2b364a5a209747f48ecc2b2dc670. The flaw is located in the /paid/selectall.action file, where the zuname argument can be manipulated by remote attackers to inject SQL commands. The vulnerability allows unauthorized access or modification of data and can be exploited remotely without authentication. Due to the use of continuous delivery with rolling releases, no specific affected or fixed versions are identified. The vendor did not respond to early disclosure attempts. No official patches or mitigations have been published.

The vulnerability enables remote attackers to perform SQL injection attacks via the zuname parameter, potentially leading to unauthorized data disclosure, data modification, or denial of service. The CVSS 3.1 score of 7.3 reflects a moderate impact on confidentiality, integrity, and availability. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches or fixes are available, users should monitor official channels for updates. Until a fix is available, consider implementing application-layer input validation or web application firewall rules to detect and block malicious input targeting the zuname parameter.