Description
Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.
Remediation
References
Related Vulnerabilities
WordPress Plugin ARForms:Wordpress Form Builder Arbitrary File Deletion (3.5.1)
WordPress 4.1.x PHP Object Injection (4.1 - 4.1.32)
WordPress Plugin Child Theme Creator by Orbisius Cross-Site Request Forgery (1.5.1)
WebLogic CVE-2021-35552 Vulnerability (CVE-2021-35552)
WordPress Plugin Comic Book Management System SQL Injection (2.1.0)