Web Forums Server versions 1.6 and 2.0 suffer from directory traversal attacks and also store passwords in cleartext.