User ID controlled by request parameter with password disclosure 1 Access Control Vulnerabilities Lab 8 Dec 4, 2024