Now, once another episode of cross site scripting disclosure. This time we have some free software web applications. Sadly, none of them was able to provide a fix in a decent timeframe.
CVE-2007-1871 XSS in chcounter
CVE-2007-1872 XSS in toendaCMS
CVE-2007-1873 XSS in mephisto