Parameter 2 User ID controlled by request parameter with data leakage in redirect Jul 3, 2024 User Role Controlled By Request Parameter May 24, 2024