Today a exploit was reported in messages.php, the main file responsible for the Private Message System. It is been brought to attention of the developers and they will release a patch as soon as possible.
If you want to be certain that your site will not be affected by this exploit you are advised to remove messages.php from your server until the patch has been released.
Update: 12.53 GMT: This issue also applies to v6 versions of PHPFusion.
It should be noted it will only be when magic_quotes is set to off (applies both to v6 and v7). Update: 13.10 GMT: According to Digitanium the risk is relatively low.
PLEASE NOTE: The Private Message System has been disabled temporarily on this site, too.
