CVE-2026-14953

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

CVE-2026-14953: Direct Request

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

CVE-2025-7593 code-projects Job Diary view-all.php sql injection

A vulnerability was found in code-projects Job Diary 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-all.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to t...

CVE-2025-7593 code-projects Job Diary view-all.php sql injection

A vulnerability was found in code-projects Job Diary 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-all.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to t...

CVE-2025-7593: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Job Diary 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-all.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to t...

PT-2023-32839

Name of the Vulnerable Software and Affected Versions Tongda OA versions 2017 up to 11.9 Description A critical issue affects an unknown functionality of the file general/work plan/manage/delete all.php. The manipulation of the DELETE STR argument leads to sql injection. The attack can be launche...

CVE-2022-4157: Undefined Security Weakness

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cgoptionid POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges i.e. on multisite...

PT-2021-22584

Name of the Vulnerable Software and Affected Versions: VFront version 0.99.5 Description: Multiple Cross Site Scripting XSS vulnerabilities exist in the software via the s parameter in "search all.php" and the msg parameter in "add.attach.php". Recommendations: For VFront version 0.99.5, consider...

PT-2017-14891

Name of the Vulnerable Software and Affected Versions Entrepreneur Job Portal Script version 2.0.6 Description The issue is related to SQL Injection, which occurs via the rid1 parameter in the "jobsearch all.php" endpoint. This allows for potential exploitation. Recommendations For Entrepreneur J...

CVE-2008-6248: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in all.php in Galatolo WebManager 1.3a and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter...

CJ Tag Board User-Agent PHP注入漏洞

CJ Tag Board是一款基于PHP的论坛程序。 CJ Tag Board不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题一是tag.php脚本对"User-Agent" HTTP头数据缺少过滤，可导致任意PHP代码注入，并通过请求all.php脚本执行。 问题二是adminindex.php脚本对用户提交的"banned"参数缺少过滤，可导致任意PHP代码注入。 CJ Tag Board 3.0 http://www.scriptsearch.com/cgi-bin/jump.cgi?ID=10068...

CVE-2006-4451

Direct static code injection vulnerability in CJ Tag Board 3.0 allows remote attackers to execute arbitrary PHP code via the 1 User-Agent HTTP header in tag.php, which is executed by all.php, and 2 the banned parameter in adminindex.php...

CVE-2006-4451

Direct static code injection vulnerability in CJ Tag Board 3.0 allows remote attackers to execute arbitrary PHP code via the 1 User-Agent HTTP header in tag.php, which is executed by all.php, and 2 the banned parameter in adminindex.php...