PHP APC versions 3.1.1, 3.0.19, and probably earlier releases all suffer from a cross site scripting vulnerability.