Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.
CWE-434, CWE-434