CVE-2007-1364

DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.

• http://secunia.com/advisories/24861Vendor Advisory
• http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437Patch
• http://www.securityfocus.com/bid/23400Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
• https://www.cynops.de/advisories/CVE-2007-1363.txtVendor Advisory
• http://secunia.com/advisories/24861Vendor Advisory
• http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437Patch
• http://www.securityfocus.com/bid/23400Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
• https://www.cynops.de/advisories/CVE-2007-1363.txtVendor Advisory

Published

Apr 11, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1358Cross-site scripting (XSS) vulnerability in certain applicat…
• CVE-2007-1359Interpretation conflict in ModSecurity (mod_security) 2.1.0 …
• CVE-2007-1360Unspecified vulnerability in the Nodefamily module for Drupa…
• CVE-2007-1361Cross-site scripting (XSS) vulnerability in virtuemart_parse…
• CVE-2007-1362Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4…
• CVE-2007-1363Multiple SQL injection vulnerabilities in DropAFew before 0.…
• CVE-2007-1365Buffer overflow in kern/uipc_mbuf2.c in OpenBSD 3.9 and 4.0 …
• CVE-2007-1366QEMU 0.8.2 allows local users to crash a virtual machine via…
• CVE-2007-1367Cross-site scripting (XSS) vulnerability in the login page i…
• CVE-2007-1368The Project issue tracking module before 4.7.x-1.3, 4.7.x-2.…
• CVE-2007-1369ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earl…
• CVE-2007-1370Zend Platform 2.2.3 and earlier has incorrect ownership for …