Secunia

Stuart Jamieson has reported some vulnerabilities in FuseTalk, allowing malicious people conduct Cross Site Scripting, ban users, and potentially execute administrative functions.

1) Any user can access "banning.cfm", which can be exploited to ban arbitrary users.

2) It is possible to add users via a GET request. This can be exploited by including links to this function in image tags or elsewhere. The function will be executed when the page with reference to the image is viewed by a privileged user.

3) It has also been reported that FuseTalk is vulnerable to multiple Cross Site Scripting vulnerabilities. No details have been provided.

Issue 2 may only affect version 2.
Issues 1 and 3 reportedly affect versions 2, 3, and 4.

Solution
Updates are reportedly available from the vendor.

Provided and/or discovered by
Stuart Jamieson

Deep Links
Links available in Customer Area