PHP-Stats versions 0.1.9.1 and below suffer from remote directory traversal, SQL injection, and command execution flaws.