Updated 15 July 2007: The update mentioned below caused the lost password function to fail. This has now been corrected, the fixed lostpassword.php can be found in the 6.01.11 upgrade package.
Original news:
A secunia advisory has brought to my attention an XSS in the FUSION_QUERY string. In order to fix this I have opted to use some v7 code. All users are strongly encouraged to keep their setups as up-to-date as possible, stop slacking! (Joke).
Existing v6.01.10 users can download the file '6.01.11 Update for v6.01.10 and simply upload the inluded files and click upgrade under System Admin. The full sourceforge package has also been updated. Manual updaters can find the fix details in the CVS.
