yappa-ng versions 2.3.1 and below suffer from cross site scripting and remote file inclusion vulnerabilities.