CVE-2009-4670: Beaussier Roomphplanning

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user parameter or (2) delete arbitrary rooms via the room parameter.

Affected products

• Beaussier Roomphplanning: version 1.6 only

Published 2010-03-05. Last modified 2026-06-16.