PhotoBlogger versions 3.0 and below suffer from cross site scripting and SQL injection vulnerabilities.