Cross-site scripting vulnerability in eXtreme message board (XMB) 1.6x and earlier allows remote attackers to execute script as other XMB users by inserting the script into an IMG tag.
https://docs.xmbforum2.com/index.php?title=Security_Issue_History