Emgent

The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the `f` and `fp` parameters.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters. This can be demonstrated using a tag such as "[a@url@page]" in the error.php file.