Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags.
osvdb.org/53782
secunia.com/advisories/34764
www.securityfocus.com/archive/1/502732/100/0/threaded
www.securityfocus.com/bid/34595
www.webspell.org/index.php?site=files&file=25
www.webspell.org/index.php?site=news_comments&newsID=126&lang=uk
exchange.xforce.ibmcloud.com/vulnerabilities/49937
www.exploit-db.com/exploits/8453