Secunia

A vulnerability has been identified in phpBB allowing malicious people to conduct Cross Site Scirpting attacks against users.

The problem exists if certain HTML tags like "<A>" is allowed in postings. This allows malicious people to insert javascript event handlers, which essentially can do the same as a script in a "<SCRIPT>" tag.

Example:
<a href="javascript:evil_function();">My_Site</a>

Solution
The phpBB developers suggest some possible configuration changes:
Further details available in Customer Area

Provided and/or discovered by
Marvin Massih

Deep Links
Links available in Customer Area