The setuser.php script from Digitanium for PHP-Fusion version 5.01 is vulnerable to cross site scripting attacks.