Input passed via the "cat" parameter to admin/admin.php and via the URL through various scripts (e.g. admin/admin.php, admin/ads.php, admin/affiliates.php, admin/comments.php) to functions.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Remote / Network Access
Loss of Integrity
OSVDB is not aware of a solution for this vulnerability.