John Cox has posted over on Wyome.com (his blog) some inforamtion about yet another PHP-Nuke/phpBB XSS exploit.

I don't need to be able to read Spanish to know there is another XSS exploit in PHP-Nuke via the phpBB avatar system. Discussing PHP-Nuke XSS exploits is about as pointless as discussing the color of the sky. They will continue to be found as there is not audit proceedure in place, and the sky will continue to be blue.

The exploit is that PHP-Nuke allows the avatar for a registered user to be pulled from an external source, opening up all sorts of code injection issues. Their sugguestion as of right now for a fix? Turn off the avatar system.