Simpnews has an include file vulnerability that allows a remote attacker to load malicious PHP scripts.