Drupal 4.0 - News Message HTML Injection

                							

                source: http://www.securityfocus.com/bid/5801/info

Problems with Drupal could allow an attacker to execute arbitrary script code in a vulnerable client.

Drupal fails to sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in their browser. This will occur in the context of the site running the Drupal software. 

<IMG SRC="javascript:alert('unsecure')">