Bulletin board allows attackers to determine the existence of files using the avatar.
CVE-2009-4581
PHP program allows arbitrary code execution using ".." in filenames that are fed to the include() function.
CVE-2010-0012