PHP-Nuke 7.4 has a cross site scripting flaw that allows an attacker the ability to post messages in a system newsletter.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/34279/codelabs-05.txt
Source: https://packetstormsecurity.com/files/34279/CODEBUG-Labs-Security-Advisory-5.html