Avsarsoft Matbaa Script suffers from cross site scripting and remote shell upload vulnerabilities.