Aardvark Topsites PHP version 5.2 suffers from cross site scripting and local file inclusion vulnerabilities.