{"id":"CVE-2026-3992","state":"PUBLISHED","title":"CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection","description":"A weakness has been identified in CodeGenieApp serverless-express up to 4.17.1. This affects an unknown part of the file utils/dynamodb.ts of the component Users Endpoint. This manipulation of the argument filter causes injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-03-12T05:32:09.890Z","updatedAt":"2026-03-12T14:28:51.389Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["CodeGenieApp serverless-express"],"affected":[{"vendor":"CodeGenieApp","product":"serverless-express","versions":[{"version":"4.17.0","status":"affected"},{"version":"4.17.1","status":"affected"}],"modules":["Users Endpoint"]}],"references":["https://vuldb.com/?id.350474","https://vuldb.com/?ctiid.350474","https://vuldb.com/?submit.769631","https://github.com/AnalogyC0de/public_exp/issues/19"],"weaknesses":["CWE-74","CWE-707"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/3xxx/CVE-2026-3992.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-3992","state":"PUBLISHED","datePublished":"2026-03-12T05:32:09.890Z","dateUpdated":"2026-03-12T14:28:51.389Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-11T16:51:16.896Z"},"containers":{"cna":{"title":"CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection","descriptions":[{"lang":"en","value":"A weakness has been identified in CodeGenieApp serverless-express up to 4.17.1. This affects an unknown part of the file utils/dynamodb.ts of the component Users Endpoint. This manipulation of the argument filter causes injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"CodeGenieApp","product":"serverless-express","versions":[{"version":"4.17.0","status":"affected"},{"version":"4.17.1","status":"affected"}],"modules":["Users Endpoint"]}],"references":[{"url":"https://vuldb.com/?id.350474","name":"VDB-350474 | CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.350474","name":"VDB-350474 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.769631","name":"Submit #769631 | CodeGenieApp serverless-express <=4.17.1 Property Injection","tags":["third-party-advisory"]},{"url":"https://github.com/AnalogyC0de/public_exp/issues/19","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]},{"descriptions":[{"cweId":"CWE-707","type":"CWE","lang":"en","description":"Improper Neutralization"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-03-12T05:32:09.890Z"},"timeline":[{"time":"2026-03-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-11T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-11T17:56:20.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Ana10gy (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-12T14:28:41.206552Z","id":"CVE-2026-3992","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-12T14:28:51.389Z"}}]}}}