Secunia

PHP-Nuke has been found vulnerable to a Cross Site Scripting attack in block-Forums.php.

By posting a message with a title like:
"><script>evil_code;</script>
It will be returned as valid html or script code to the users viewing the message.

Solution
Edit the source code to strip malicious characters from title or escape malicious characters using addslashes().

Provided and/or discovered by
lethalman

Deep Links
Links available in Customer Area