password_leakage 1 Lab 10: User ID controlled by request parameter with password disclosure Dec 17, 2025