DPEC Online Courseware allows an attacker to change another user's password without knowing the original password.