Collabtive version 0.4.8 suffers from cross site scripting, authentication bypass, and shell upload vulnerabilities.