This is a writeup detailing two vulnerabilities in XAMPP <= 1.7.3: a file disclosure vulnerability via `showcode.php` and a cross-site scripting (XSS) vulnerability in `phonebook.php` and `biorhythm.php`. The vulnerabilities stem from improper handling of `$_SERVER['PHP_SELF']` and `basename()`.