House

A publicly disclosed SQL injection vulnerability (CVE-2026-19062) in the house application by chiuwingyan allows unauthenticated remote attackers to execute arbitrary SQL commands via the zuname parameter.