OTManager CMS version 24a suffers from local file inclusion and cross site scripting vulnerabilities.