PPM-PFM can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.Also an URL-parameter NO_AUTH_CHECK, that seems to switch off any authorization checks, is rather suspicious in PPM. This means that any malicious user can simply add this parameter to a URL to bypass the authority checks.