CVE-2026-43881: Missing Authentication for Critical Function

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter causes the handler to set $ignoreAdmin = true for any non-admin call...

CVE-2025-11406

A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The...

CVE-2025-11406

A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The...

KaiFangQian 访问控制错误漏洞

KaiFangQian is the front-end page of an open-sign e-signature system of kaifangqian open source. An access control error vulnerability exists in KaiFangQian, which stems from an incorrect operation of the getAllUsers function and could lead to information disclosure...

CVE-2025-11406: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The...

PT-2025-41168

Name of the Vulnerable Software and Affected Versions kaifangqian kaifangqian-base affected versions not specified Description A security flaw exists in kaifangqian kaifangqian-base. The issue involves information disclosure resulting from manipulation of the getAllUsers function located in the...