AltConstructor Cross Site Scripting

`Hello Full-Disclosure!  
  
I want to warn you about Cross-Site Scripting and Brute Force   
vulnerabilities in AltConstructor. It's Ukrainian commercial CMS.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are all versions of CMS AltConstructor, before version released  
at 16.08.2010, where developers fixed holes after my informing.  
  
----------  
Details:  
----------  
  
XSS (WASC-08):  
  
http://site/search/index?search=%3Cbody%20onload='alert(document.cookie)'  
  
Brute Force (WASC-11):  
  
http://site/auth/login  
  
------------  
Timeline:  
------------  
  
2010.08.12 - announced at my site.  
2010.08.13 - informed developers.  
2010.08.14 - developers confirmed holes and begun working on fixes.  
2010.08.16 - developers released a fixes. All users of old versions of CMS  
need to contact developers for updates.  
2010.10.08 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4457/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
  
`