The textcounter.pl by Matt Wright allows remote attackers to execute arbitrary commands via shell metacharacters.
WWWBoard stores encrypted passwords in a password file that is under the web root and thus accessible by remote attackers.