Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme array parameter to admin/doedittheme.php which is injected into includes/theme.inc.php; (2) inject PHP code via a config array parameter to admin/doeditconfig.php and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the configpath parameter and then execute the code via (3) dorateuser.php (4) calendar.php and unspecified other scripts.