user vulnerability