Today, tourists go through an elaborate screening process before being allowed to visit.
The subordinate clause here is inside a Prepositional Phrase (some people would analyse it as being a clause with a subordinating conjunction):
- before being allowed to visit.
Here we have to use an -ing form of the verb because there is no subject. It's the passive auxiliary BE here which is taking the -ing form. If we omit the subject we cannot use a tensed verb. If we include it we can:
- before they are allowed to visit.
However, we can only drop the subject in a subordinate clause like this if it is the same as the subject in the main clause. If it is a different subject we can't. It we put the missing words back in to the example above, we get the following:
Today, tourists(i) go through an elaborate screening process before
their(i) being allowed to visit.
Here it's clear that tourists and their are the same people. However in the other sentence in the Original Poster's first example there is a problem:
The vulnerability(i) is due to insufficient sanitization of user-supplied data(ii) before ___(ii) being used to execute commands.
Here the subject of the main clause is the vulnerability. However, the writer's intended subject of the subordinate clause is not the vulnerability but the user supplied data. The problem is user supplied data cannot grammatically be the subject here, because it isn't the subject of the main clause! Because the subjects of the two clauses are different, we cannot drop the subject in the subordinate one. The correct sentence would have to read thus:
The vulnerability is due to insufficient sanitization of user-supplied data before its being used to execute commands.
The its here is a bit ambiguous so we may prefer a tensed clause with a full subject:
The vulnerability is due to insufficient sanitization of user-supplied data before this data is used to execute commands.