Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode 1 img or 2 url tags, which are not properly handled when a post is viewed...