Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')