CoolPHP 1.0-stable is susceptible to cross site scripting, path disclosure, and directory traversal attacks.