Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the reason parameter in 1 actions/nominatemedal.php or 2 actions/requestmedal.php...