Kissifrot

The issue allows remote attackers to execute arbitrary PHP code. This is possible when a public stats page is provided. The exact vectors used for the attack are not specified.