MISC:http://www.milw0rm.com/exploits/2229 I verified this issue by source inspection. The first PHP statement in each of the four referenced files has something like the following: require_once("$CONFIG[gameroot]/qlib/thirdparty/kses/kses.php"); (this one was from core/includes/security.inc.php) - Steve