WWWBoard stores encrypted passwords in a password file that is under the web root and thus accessible by remote attackers.
matt wright wwwboard 2.0_alpha_2.1