The phpMyChat Plus v1.94 RC1 is vulnerable to Remote Blind SQL Injection, Remote File Inclusion, Local File Inclusion, and XSS. For Remote Blind SQL Injection, an attacker can use some automatic blind SQL injection to get database information. For Remote File Inclusion, the allow_url_include must be set to On. For Local File Inclusion, the magic_quotes_gpc must be set to Off. For XSS, an attacker must have a good brain.