QUOTE(russian seciruty lab)
Possible XSS:
1. Vulnerability exists in a field "msg_title" in personal messages...:
"><script>alert()</script>
2. Vulnerability exists at processing BB tags. The user can to execute by means of specially generated message any HTML leather in a browser of a victim.
Examples:
[pīst=[tīpic=100]
Click me!
[/tīpic]]
Click me!
[/pīst]
1. Vulnerability exists in a field "msg_title" in personal messages...:
"><script>alert()</script>
2. Vulnerability exists at processing BB tags. The user can to execute by means of specially generated message any HTML leather in a browser of a victim.
Examples:
[pīst=[tīpic=100]
Click me!
[/tīpic]]
Click me!
[/pīst]
It already fixed in IPB 2.0.4 or this small bugs?