editprofile.php

editprofile.php doesn't do any authentication. As a result, anyone can edit any profile without even logging in.