A2billing version 2.x suffers from backup disclosure, remote code execution, and remote SQL injection vulnerabilities.