CVE-2015-9286: Improper Neutralization of Input During Web Page Generation

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...