VULNERABILITY INTELLIGENCE
CVE-2007-1364
CVSS score6.4 MEDIUM
EPSS probability2.25%
CISA KEVNot currently listed
Published2007-04-11
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Description
DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
Primary references
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Patch
- cve@mitre.org — Exploit
- cve@mitre.org
- cve@mitre.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch
- af854a3a-2127-422b-91ae-364da2661108 — Exploit
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory