Mahmoud Gamal

An authorization issue exists due to improper state management, which may allow an application to bypass Privacy preferences.

A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that create a new admin via a request to "administrator/admins create.php".