[ThorstenA]

Security issue. A user may delete other users results by entering their formresults id.

In plugin Easy Forms Part 2 replace

if ($_REQUEST['do'] == 'deleteformresult') 
{ 
    $caneditform = unserialize($vbulletin->options['caneditform']); 
    if ($caneditform && !is_member_of($vbulletin->userinfo, $caneditform)) 
    { 
        print_no_permission(); 
    } 
    $id = $vbulletin->input->clean_gpc('g', 'id', TYPE_UINT); 
    $fid = $vbulletin->input->clean_gpc('g', 'fid', TYPE_UINT); 
    $db->query_write("DELETE FROM " . TABLE_PREFIX . "formresults WHERE id=$id"); 

to

if ($_REQUEST['do'] == 'deleteformresult') 
{ 
    $caneditform = unserialize($vbulletin->options['caneditform']); 
    if ($caneditform && !is_member_of($vbulletin->userinfo, $caneditform)) 
    { 
        print_no_permission(); 
    } 
    $id = $vbulletin->input->clean_gpc('g', 'id', TYPE_UINT); 
    $db->query_write("DELETE FROM " . TABLE_PREFIX . "formresults WHERE id=$id and userid=" . $vbulletin->userinfo[userid] . ""); 

The $fid seems to be not needed and therefore does not need to be included in the url.