XSS using onerror

We had a user enter a viagra ad that actual redirected to their site. I think the offending code was here: although obviously they didn't use example.com I've attached the whole page for examination...

CVE-2006-3767

The CVE-2006-3767 entry describes a Cross-site Scripting (XSS) vulnerability in Darren's osDate 1.1.7 and earlier (showprofile.php) that allows remote attackers to inject arbitrary script/HTML via the onerror attribute in an HTML IMG tag with a non-existent src, used when posting a comment (txtco...

CVE-2006-3767: Undefined Security Weakness

Cross-site scripting XSS vulnerability in showprofile.php in Darren's $5 Script Archive osDate 1.1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the onerror attribute in an HTML IMG tag with a non-existent source file in txtcomment parameter, which is used when...

CVE-2002-1829: Undefined Security Weakness

Cross-site scripting XSS vulnerability in codeparse.php in Open Bulletin Board OpenBB 1.0.0 RC3 allows remote attackers to inject arbitrary web script or HTML via 1 myhome.php, 2 an onerror attribute in an IMG tag a variant of CVE-2002-0330, or 3 a glow tag...