Agares PhpAutoVideo versions 2.21 and below suffer from cross site scripting and remote file inclusion vulnerabilities.