PunBB < 1.2.6 Multiple Vulnerabilities

The remote version of PunBB contains a flaw in its template system that can be exploited to read arbitrary local files or, if an attacker can upload a specially crafted avatar, to execute arbitrary PHP code. In addition, the application fails to sanitize the 'temp' parameter of the 'profile.php'...