PowerPortal version 1.x suffers from full path disclosure, cross site scripting, and arbitrary directory browsing flaws.