Several free form data mailer scripts allow attacker to steal Hotmail passwords with a simple javascript-based exploit.