Vcard 2.9 - Unauthenticated Arbitrary Uninstall via uninstall.php
Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote attackers to uninstall Vcard and delete database tables via a direct request to uninstall.php.