CVE-2006-1711 – Plone 2.x - MembershipTool Access Control Bypass

https://notcve.org/view.php?id=CVE-2006-1711

11 Apr 2006 — Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits. • https://www.exploit-db.com/exploits/27630 •