Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')