Cross-site scripting (XSS) vulnerability in index.php for Mambo Site Server 4.0.10 allows remote attackers to execute script on other clients via the ?option parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/11601
http://archives.neohapsis.com/archives/bugtraq/2003-03/0275.html