AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

CVE-2026-43881 fix d9cdc7024 patched users.json.php only. The same anti-pattern survives at master HEAD in: objects/mention.json.php:17 $ignoreAdmin = true; objects/mention.json.php:18 $users = User::getAllUsers$ignoreAdmin, 'name', 'email', 'user', 'channelName', 'a'; No User::loginCheck, no adm...

CVE-2001-1032

PHP-Nuke 5.2 and earlier (except 5.0RC1) is vulnerable to an arbitrary file upload via admin.php due to missing authentication for upload operations. An attacker can copy/upload arbitrary files and read the PHP-Nuke configuration by invoking admin.php with an upload parameter and a target file. T...