I just tested one recently that used client-side Javascript to generate the new temporary password for whatever account was submitted in the POST parameter. Ne

I just tested one recently that used client-side Javascript to generate the new temporary password for whatever account was submitted in the POST parameter. Needless to say, you could arbitrarily set any account's password to whatever you wanted. Account harvesting through the password reset functionality is one that pops up all the time. A lot of businesses now just accept the risk (which I no longer really get all that worked up over, at least provided they aren't also enforcing account lockout for invalid attempts)