phpMyConferences versions 8.0.2 and prior suffer from remote file inclusion in the lvc_include_dir variable.