postnuke -- multiple vulnerabilities

Postnuke Security Announcementss reports of the following vulnerabilities:

• missing input validation within /modules/Messages/readpmsg.php
• possible path disclosure within /user.php
• possible path disclosure within /modules/News/article.php
• possible remote code injection within /includes/pnMod.php
• possible cross-site-scripting in /index.php

[source]

• remote code injection via xml rpc library

[source]