Fresh Email Script versions 1.0 to 1.11 suffer from file inclusion and cookie manipulation vulnerabilities.