XZero Community Classifieds versions 4.95.11 and below suffer from local file inclusion and SQL injection vulnerabilities.