$_GET['tab'] is not escaped.

When we use word thumb at the begining of $_GET['image'] it's possible to omit preg_match() function.

$_GET['tab'] is not escaped.

We can read and display any external file using $_REQUEST['code'].

$_GET['submenu'] is not escaped.

`ShareaholicAdmin

Name field in chat.php may be used to send XSS visible inside Webbased Operator Client.

Anyone can run user defined function because of _call_userfunc().