Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.
Max CVSS
4.3
EPSS Score
0.22%
Published
2007-10-19
Updated
2021-04-19
1 vulnerabilities found