source: http://www.securityfocus.com/bid/9308/info

Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML and script code embedded in URI parameters. If the link is followed, the attacker-supplied code may be rendered in the victim user's browser.

Possible consequences of exploitation include theft of cookie-based authentication credentials or using the issue as an attack vector to exploit latent web browser security flaws.

http://www.example.com/index.php?page=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E