Network Query Tool version 1.6 suffers from a cross site scripting and full path disclosure vulnerability.