User ID controlled by request parameter with password disclosure 1 User ID controlled by request parameter with password disclosure Dec 4, 2024