Description
A cross-site scripting (XSS) vulnerability exists in miniBB through the "whatus" parameter. The parameter value is reflected in the page without proper HTML encoding.
Impact
Attackers can inject malicious JavaScript that executes when other forum users view affected pages, enabling cookie theft and session hijacking.
Solution
Apply output encoding to the whatus parameter. Upgrade to the latest version of miniBB.