Subdreamer CMS version 3.7.1 suffers from local file inclusion and remote file upload vulnerabilities.