Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...