Hi! I have founded a bug in Phorum (http://phorum.org/). It is possible to inject script code or other html-tag into "subject", "author's name" or "author's e-mail" of a message in Phorum. In the subject (name, e-mail) input of message you need to write any html-tag like this: <<b>script>alert(document.cookie);<<b>/script> I have tested it on Phorum 3.4.1 but probably works in other Phorum 3.x.x versions. Greetings! WiciU, Poland vviciu@poczta.onet.pl
