:Khashayar Fereidani has discovered some vulnerabilities in Maian Weblog, which can be exploited by malicious people to conduct cross-site scripting attacks.Input passed to the "keywords" parameter in index.php and admin/index.php, and "msg_charset" and "msg_header9" in admin/inc/header.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.The vulnerabilities are confirmed in version 4.0. Other versions may also be affected.Solution:Edit the source code to ensure that input is properly sanitised.Provided and/or discovered by:Khashayar Fereidani a.k.a. Dr.Crash

Original post by sonia