Musicbox versions 2.3.8 and below suffer from a remote SQL injection vulnerability. This was discovered in the last version and the vendor still has not fixed it.
The Visitor Messages add-on for vBulletin version 3.7.3 suffers from cross site scripting and cross site request forgery vulnerabilities. This is a worm exploit that takes advantage of these issues.