Program-O version 2.4.6 suffers from http response splitting, cross site scripting, and local file inclusion vulnerabilities.