{"vulnerability": "CVE-2026-3919", "sightings": [{"uuid": "3befc5d7-af36-4cdf-b844-6b7ece894c0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3919", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0298/", "content": "", "creation_timestamp": "2026-03-16T00:00:00.000000Z"}, {"uuid": "f759c17a-1b6b-4296-a07a-023013162870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3919", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgvey4sbq22s", "content": "", "creation_timestamp": "2026-03-12T21:50:05.179450Z"}, {"uuid": "18dc4a11-d96b-4c22-a3fd-841d324fa07d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3919", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116214214929795362", "content": "", "creation_timestamp": "2026-03-12T04:03:14.002074Z"}, {"uuid": "9471c7d6-3ef4-424f-9ebd-45c9182b8f77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260312", "content": "", "creation_timestamp": "2026-03-12T01:00:00.000000Z"}, {"uuid": "5fd265c2-dd79-4d00-972b-e7811f8b5a5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260316", "content": "", "creation_timestamp": "2026-03-16T01:00:00.000000Z"}, {"uuid": "b8f7ac11-58ba-44ba-a573-8e7cb7afcd6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39197", "type": "seen", "source": "https://gist.github.com/pyuysig/221e90dd598ab3f3c3100ae59db8e8d4", "content": "# Vulnerability Report: CVE-2026-39197 - Vector - HTTP and gRPC ingest body buffering can cause memory exhaustion\n\n## Vulnerability Summary\nVector 0.54.0 contains missing inbound size controls in several HTTP and gRPC ingest paths. A remote attacker can submit an oversized request body or highly compressed payload that is fully buffered or decompressed before an effective size limit is enforced, leading to memory exhaustion and denial of service.\n\n## Affected Product\n- **Vendor**: Vector Contributors\n- **Product**: Vector\n- **Version**: 0.54.0\n- **Vulnerable Component**: src/sources/util/http/prelude.rs, src/sources/util/http/encoding.rs, src/sources/opentelemetry/http.rs, src/sources/splunk_hec/mod.rs, src/sources/util/grpc/decompression.rs, src/sources/vector/mod.rs, src/sources/opentelemetry/config.rs\n\n## Vulnerability Details\n- **Vulnerability Type**: Resource Management Error / Algorithmic Complexity\n- **Weakness**: CWE-400, CWE-770\n- **Attack Conditions**: Remote. The attacker must be able to reach an enabled Vector HTTP or gRPC ingest endpoint; compressed-payload variants depend on the relevant content encoding or gRPC compression path being enabled.\n\n## Report Body\n\n### Summary\nVector 0.54.0 contains missing inbound size controls in several HTTP and gRPC ingest paths. A remote attacker can submit an oversized request body or highly compressed payload that is fully buffered or decompressed before an effective size limit is enforced, leading to memory exhaustion and denial of service.\n\n### Details\nThe affected paths buffer HTTP request bodies or inflate compressed data into memory before enforcing a practical application-level size ceiling. The gRPC decompression layer disables tonic decode-size protection and only performs size checks after decompression.\n\n### PoC\n1. Prepare an environment matching the affected product and version above.\n2. Trigger the vulnerable component under the attack conditions described for CVE-2026-39197.\n3. Confirm the security result: Sending an oversized HTTP body, a highly compressed HTTP payload, or a large compressed gRPC message causes attacker-controlled memory growth before rejection, producing a repeatable denial-of-service condition.\n\n### Impact\nRemote denial of service through process memory exhaustion, crash, or restart loops on enabled ingest endpoints.\n\n## Remediation\nApply maximum body and decompressed-output limits before allocation and decompression. Preserve framework decode limits unless an equivalent pre-decompression limit is installed.\n\n## Credit\n- Discoverer(s): Yuming Zhang and Song Li of Zhejiang University\n\n## Notes\nThis public reference is intended to support the CVE record with concise, factual vulnerability details. It intentionally avoids a full exploit release.\n", "creation_timestamp": "2026-06-13T12:45:32.000000Z"}, {"uuid": "acb837cb-a120-4f5f-9bb1-a64c20ccea60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39196", "type": "seen", "source": "https://gist.github.com/pyuysig/423b15c69e3cd851c1e24c1312a0551a", "content": "# Vulnerability Report: CVE-2026-39196 - Vector - SQL injection in ClickHouse sink database template handling\n\n## Vulnerability Summary\nDatadog Vector 0.54.0 contains a SQL injection issue in the ClickHouse sink query construction path. When the clickhouse sink database setting is rendered from attacker-controlled event fields, an attacker can inject SQL syntax into the generated INSERT query and redirect writes to unintended ClickHouse tables accessible to the Vector credential.\n\n## Affected Product\n- **Vendor**: Datadog, Inc.\n- **Product**: Vector\n- **Version**: 0.54.0\n- **Vulnerable Component**: src/sinks/clickhouse/config.rs, src/sinks/clickhouse/sink.rs, src/sinks/clickhouse/service.rs, KeyPartitioner::partition, set_uri_query\n\n## Vulnerability Details\n- **Vulnerability Type**: SQL Injection\n- **Weakness**: CWE-89\n- **Attack Conditions**: Remote. The attacker must be able to submit events into a Vector pipeline whose ClickHouse sink uses a dynamic database template derived from attacker-controlled event fields.\n\n## Report Body\n\n### Summary\nDatadog Vector 0.54.0 contains a SQL injection issue in the ClickHouse sink query construction path. When the clickhouse sink database setting is rendered from attacker-controlled event fields, an attacker can inject SQL syntax into the generated INSERT query and redirect writes to unintended ClickHouse tables accessible to the Vector credential.\n\n### Details\nThe ClickHouse sink allows both table and database to be configured as templates. During partitioning, event data is rendered into the database and table values. The HTTP query builder then constructs INSERT INTO \"{database}\".\"{table}\" FORMAT ... but only escapes quotes in table, leaving database unescaped. URL encoding the HTTP query parameter does not neutralize SQL syntax after ClickHouse decodes the request.\n\n### PoC\n1. Prepare an environment matching the affected product and version above.\n2. Trigger the vulnerable component under the attack conditions described for CVE-2026-39196.\n3. Confirm the security result: A configuration such as database = \"{{ target_db }}\" and table = \"safe_table\" can be driven with target_db set to prod\".\"admin_logs\" FORMAT JSONEachRow -- . The resulting query changes the target from the configured table to prod.admin_logs if the target table schema and privileges permit it.\n\n### Impact\nIntegrity impact against downstream ClickHouse data. The demonstrated impact is attacker-controlled alteration of the INSERT target table and log or audit data poisoning, subject to sink configuration and ClickHouse permissions.\n\n## Remediation\nEscape or quote database identifiers using the same or stronger rules as table identifiers, or avoid SQL string construction from rendered templates. Consider validating rendered database and table identifiers against an allowlist.\n\n## Credit\n- Discoverer(s): Yuming Zhang and Song Li of Zhejiang University\n\n## Notes\nThis public reference is intended to support the CVE record with concise, factual vulnerability details. It intentionally avoids a full exploit release.\n", "creation_timestamp": "2026-06-13T12:45:31.000000Z"}, {"uuid": "cabc5725-9421-47dd-915e-db855b62df73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39192", "type": "seen", "source": "https://gist.github.com/7h30th3r0n3/d3063b5d02a41745bc5f2e4b44b272c1", "content": "# CVE-2026-39192 \u2013 Sensitive File Exposure in StandVoice by Conviviance\n\n**Product**: StandVoice  \n**Vendor**: Conviviance  \n**Versions Affected**: 6.2 and before  \n**Vulnerability Type**: Incorrect Access Control (CWE-540, CWE-312, CWE-532, CWE-548)  \n**CVE ID**: CVE-2026-39192  \n**Related**: CVE-2024-42533 (exposed source code reveals all SQLi entry points from that advisory)  \n**Reporter**: 7h30th3r0n3 \u2013 OSINX  \n**CVSS v3.1 Base Score**: 7.5 (High)  \n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n---\n\n## Description\n\nStandVoice by Conviviance (version 6.2 and before) exposes sensitive files to unauthenticated remote attackers due to Apache misconfiguration. Directory listing is enabled and `.inc` PHP files are served as plaintext on multiple directories, allowing any remote attacker to browse and download all exposed files via simple HTTP GET requests.\n\n**Sensitive data exposed includes:**\n\n- **MySQL credentials** in `/Init/init.inc` (user: `CDBE`, database: `Conviviance`) in cleartext\n- **Google Cloud Platform service account private key** in `/Init/credentials.json` (project: `projet1-dev`), enabling potential access to associated cloud resources\n- **Google Sheets** spreadsheet ID and API integration details\n- **50+ PHP source files** in `/Includes/` with complete application logic (database abstraction layer, authentication logic, Windows Registry access classes, and all business logic)\n- **Log files** in `/Log/` containing complete SQL queries with schema information, user login attempts with credentials in cleartext, session identifiers and internal file paths\n- **log4php configuration** in `/Init/config.xml` confirming TRACE level logging with 100-file retention\n- **Internal Windows file paths** and server configuration details\n\nThe combination of exposed database credentials and source code effectively provides full unauthenticated access to the application backend. This vulnerability is related to CVE-2024-42533 as the exposed source code reveals all SQL injection entry points exploited in that advisory.\n\n---\n\n## Technical Details\n\n**Root Cause:**\n- Apache is configured to serve `.inc` files as `text/plain` instead of interpreting them as PHP.\n- Directory listing (`Options +Indexes`) is enabled on sensitive directories.\n\n**Affected Paths:**\n\n| Path | Content | CWE |\n| --- | --- | --- |\n| `/Init/init.inc` | MySQL server, username, password, database name in cleartext | CWE-540, CWE-312 |\n| `/Init/credentials.json` | Full GCP service account private key | CWE-540 |\n| `/Init/config.xml` | log4php config with TRACE level, 100-file retention | CWE-540 |\n| `/Includes/` | 50+ `.inc` source files (~1 MB total application logic) | CWE-540 |\n| `/Log/` | Rotating log files with SQL queries, credentials, sessions | CWE-532 |\n\n**Attack Vector:**\n- Unauthenticated HTTP GET requests only.\n- No interaction, authentication, or special tools required.\n\n---\n\n## Impact\n\n- **Credential Exposure**: Database credentials and GCP service account key exposed in cleartext.\n- **Source Code Disclosure**: Complete application logic available for analysis, enabling targeted exploitation of further vulnerabilities.\n- **Cloud Resource Compromise**: GCP private key allows potential access to associated cloud project resources.\n- **User Data Leakage**: Log files contain user credentials, session identifiers, and full SQL queries.\n- **Full Reconnaissance**: Exposed source code, configuration, and logs provide complete knowledge of the application architecture.\n\n---\n\n## Timeline\n\n>     June 14, 2024: Discovery of related SQL injection vulnerability (CVE-2024-42533).\n>     June 17, 2024: Initial vulnerability report sent to Conviviance.\n>     June 25, 2024: Conviviance confirms patch available in latest version above 6.x.\n>     2026: Discovery of sensitive file exposure and Apache misconfiguration.\n>     August 26, 2026: CVE-2026-39192 assigned by MITRE.\n\n_Disclosure timestamp: 2026-08-26_\n\n---\n\n## References\n\n- [CVE-2024-42533 \u2013 SQL Injection Advisory](https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8)\n- [Conviviance](http://conviviance.com)\n- [StandVoice](http://standvoice.com)\n\n---\n\n## Discoverer / Credits\n\nReported by **7h30th3r0n3** \u2013 [OSINX](https://osinx.fr)\n", "creation_timestamp": "2026-08-26T08:09:19.585794Z"}, {"uuid": "fc98c37c-d1d4-446d-aad3-8c54f409a02e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39191", "type": "seen", "source": "https://gist.github.com/7h30th3r0n3/0417c90c483638a47c269ca535dfae99", "content": "# CVE-2026-39191 \u2013 SQL Injection to RCE in StandVoice by Conviviance\n\n**Product**: StandVoice  \n**Vendor**: Conviviance  \n**Versions Affected**: 4.5 through 6.2  \n**Vulnerability Type**: SQL Injection / Code Injection (CWE-89, CWE-94)  \n**CVE ID**: CVE-2026-39191  \n**Related**: CVE-2024-42533 (same SQLi entry point, different exploitation technique and impact)  \n**Reporter**: 7h30th3r0n3 \u2013 OSINX  \n**CVSS v3.1 Base Score**: 10.0 (Critical)  \n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`\n\n---\n\n## Description\n\nA critical SQL Injection vulnerability in the authentication module of Conviviance StandVoice (versions 4.5 through 6.2) allows a remote, unauthenticated attacker to achieve arbitrary code execution. By injecting a `UNION SELECT \u2026 INTO OUTFILE` payload into the `Login` parameter (`GEST_LOGIN` field) of `Identification.php`, an attacker can write a PHP webshell directly to the web root. The webshell is then executed with **NT AUTHORITY\\SYSTEM** privileges, resulting in full system compromise.\n\nThis vulnerability is related to CVE-2024-42533 which covers the same SQL injection entry point but was limited to authentication bypass. CVE-2026-39191 demonstrates a different exploitation technique escalating from SQL injection to remote code execution.\n\n---\n\n## Technical Details\n\n**Injection Point:**\n- **Endpoint**: `POST /Identification.php?TYPE=Master`\n- **Parameter**: `Login` (`GEST_LOGIN` field)\n- **Authentication Required**: None\n\n**Exploitation Chain:**\n\n1. The `Login` parameter is passed unsanitized into a SQL query.\n2. Using a `UNION SELECT` statement combined with `INTO OUTFILE`, the attacker writes arbitrary PHP code to the web-accessible directory.\n3. The written PHP file acts as a webshell, accessible via a direct HTTP request.\n4. The webshell executes commands as **NT AUTHORITY\\SYSTEM** (the service account running the web server on Windows).\n\n**Impact Summary:**\n\n- **Remote Code Execution**: Arbitrary OS commands via webshell.\n- **Privilege Escalation**: Code runs as NT AUTHORITY\\SYSTEM.\n- **Full System Compromise**: Complete control over the affected server.\n\n---\n\n## Impact\n\n- **Code Execution**: Arbitrary command execution on the underlying operating system.\n- **Privilege Escalation**: Webshell runs with the highest Windows privilege level (SYSTEM).\n- **Data Exfiltration**: Full read access to all files and databases on the server.\n- **Lateral Movement**: Compromised server can be used as a pivot point for further attacks.\n\n---\n\n## Timeline\n\n>     June 14, 2024: Discovery of the original SQL injection vulnerability (CVE-2024-42533).\n>     June 17, 2024: Initial vulnerability report sent to Conviviance.\n>     June 25, 2024: Conviviance confirms patch available in latest version above 6.x.\n>     August 23, 2024: CVE-2024-42533 assigned.\n>     2026: Discovery of RCE exploitation technique on the same injection point.\n>     August 26, 2026: CVE-2026-39191 assigned by MITRE.\n\n_Disclosure timestamp: 2026-08-26_  \n_The SQL injection has been patched in versions above 6.x._\n\n---\n\n## References\n\n- [CVE-2024-42533 \u2013 Original SQL Injection Advisory](https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8)\n- [Conviviance](http://conviviance.com)\n- [StandVoice](http://standvoice.com)\n\n---\n\n## Discoverer / Credits\n\nReported by **7h30th3r0n3** \u2013 [OSINX](https://osinx.fr)\n", "creation_timestamp": "2026-08-26T08:09:19.791407Z"}]}