phpVibe versions prior to 4.20 suffer from a persistent cross site scripting vulnerability.