IBL Online Weather prior to 4.3.5a allows unauthenticated reflected XSS via the redirect page.
iblsoft online weather