Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.php with the is_js_confirmed parameter set to 1, or (2) delete arbitrary accounts via the mytable parameter to delete.php.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Butterfly_organizer | Butterflymedia | 2.0.0 (including) | 2.0.0 (including) |