PHPNuke-Clan versions 4.2.0 and below suffer from a remote file inclusion vulnerability in mvcw_conver.php.