CVE-2025-8922 code-projects Job Diary admin-inbox.php sql injection

A vulnerability was found in code-projects Job Diary 1.0. This affects an unknown part of the file /admin-inbox.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-8922

The CVE-2025-8922 entry corresponds to a SQL injection vulnerability in code-projects Job Diary 1.0, specifically in the admin-inbox.php file where the ID parameter is not validated. Published details from multiple connected sources confirm remote exploitation and public disclosure of the exploit...

CVE-2025-8922 code-projects Job Diary admin-inbox.php sql injection

A vulnerability was found in code-projects Job Diary 1.0. This affects an unknown part of the file /admin-inbox.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used...

PT-2025-33065 · Code Projects · Job Diary

Name of the Vulnerable Software and Affected Versions: code-projects Job Diary version 1.0 Description: A SQL injection issue exists due to the manipulation of the ID argument in the /admin-inbox.php file. This allows for remote exploitation. The exploit has been publicly disclosed...

Code-Projects Job Diary 注入漏洞

Job Diary is a job diary software. Job Diary suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter ID in the file /admin-inbox.php. An attacker can exploit this vulnerability to execute illegal SQL commands to...

FreeScout 安全漏洞

FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a security bypass vulnerability caused by a failure to check for missing password fields in data from users. An attacker could exploit the...

CVE-2024-55186

An IDOR Insecure Direct Object Reference vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging...

CVE-2022-28747

Key reuse in GoSecure Titan Inbox Detection & Response IDR through 2022-04-05 leads to remote code execution. To exploit this vulnerability, an attacker must craft and sign a serialized payload...

CVE-2021-29349

Mahara 20.10 is affected by Cross Site Request Forgery CSRF that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieformdeleteallnotifications...

CVE-2010-2015

Multiple SQL injection vulnerabilities in LiSK CMS 4.4 allow remote attackers to execute arbitrary SQL commands via 1 the id parameter in a viewinbox action to cp/cpmessages.php or 2 the id parameter to cp/editemail.php...

CVE-2002-2165

The IMHO Webmail module 0.97.3 and earlier for Roxen leaks the REFERER from the browser's previous login session in an error page, which allows local users to read another user's inbox...

pixiv: Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net

A vulnerability was discovered in the messaging system of Pixiv.net. The vulnerability allowed any user to bypass the inbox privacy settings and send messages to another user who had disabled their inbox. The vulnerability was triggered by manipulating the id parameter in the message-sending POST...

CVE-2025-32947

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities...

CVE-2025-32948

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs Blind SSRF. Attackers can send ActivityPub activities to PeerTube's "inbox" endpoint. By abusing the "Create Activity" functionality, it is possible to creat...

CVE-2025-32947

CVE-2025-32947 concerns PeerTube. The connected documents describe a DoS via an infinite loop in the "+inbox+" endpoint triggered by crafted ActivityPub activities, causing the PeerTube server to stop responding to requests. Affected software is PeerTube; the root cause is an infinite loop in han...

CVE-2025-32947

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities...

PT-2025-16344

Name of the Vulnerable Software and Affected Versions PeerTube affected versions not specified Description This issue allows an attacker to cause the PeerTube server to become unresponsive due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities. The estimated...

CVE-2025-32947: Loop with Unreachable Exit Condition

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receiving crafted ActivityPub activities...

CVE-2025-22927

An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php=save...

PT-2025-14637 · Opensips · Opensis

Name of the Vulnerable Software and Affected Versions: openSIS versions 7.0 through 9.1 Description: A SQL injection issue was found in the Inbox module via the cp id parameter at the "/modules/messages/Inbox.php" API endpoint. Recommendations: For openSIS versions 7.0 through 9.1, as a temporary...