Is there more information about how this can be exploited or what the supposed vulnerability is?

Nothing in your post shows me a vulnerability. You'll have to be more clear on proving a vulnerability exists. What steps to exploit it?

The parmater skin in a get request can set the skin if it points to a skin that exists. If you are saying that somehow script can be injected into the page with this param I need to see proof of it. Show me how to construct an url that fires that alert and I'll believe you.

Best,

Joe

I have fixed this here and plan to package a new release of mojoPortal tommorrow. 

I think the worst case scenario of this vulnerability is the possibility of crafting a link that could steal a user's session cookie and the attacker could then have the same priveleges as the user who was attacked. The attacker would have to manage to get the user to click the link somehow from an email or other web site, and the user would have to already be logged into the mojoportal site for this to work. 

Nevertheless, with any security vulnerability I think its best to get a fix out right away.

Thanks again for reporting it.

Joe

This is now fixed in version 2.2.9.6

Thanks,

Joe