CVE-2005-1078

XAMPP 1.4.x has multiple default or null passwords, which allows attackers to gain privileges.

CVE-2007-2080

Multiple SQL injection vulnerabilities in XAMPP 1.6.0a for Windows allow remote attackers to execute arbitrary SQL commands via unspecified vectors in certain test scripts.