Not so long ago it was reported critical vulnerability in forumnyh engine IP.Board, allowing through php code inserted in the avatar user to execute arbitrary code on the compromised system, and download any files.

Vulnerability affects almost all versions of IP.Board. At the moment, there is a massive hacking forums on this engine.