Hi,
Oracle Reports URL example: https://student.college.com/reports/rwservlet?college&report=PAYSLIP&destype=cache&desformat=pdf&STUDENT_ID=C0001
the student just change the report name then able to access the other reports if they know the reports file name.
any method to prevent this happen?