CVE-2009-3168
Web application does not restrict access to admin scripts, allowing authenticated users to reset administrative passwords.
CVE-2009-3597
Web application stores database file under the web root with insufficient access control (CWE-219), allowing direct request.