Multiple cross-site request forgery (CSRF) vulnerabilities in BugTracker.NET before 2.7.2 allow remote attackers to delete arbitrary bugs and perform other administrative tasks via unspecified vectors possibly related to delete_*.aspx pages and massedit.aspx subscribe.aspx flag.aspx and relationships.aspx.