Multiple content management systems has been found to be vulnerable to injection of HTML code.

The content management systems may have reasons to allow trusted users to insert HTML code, however the systems fail to strip more dangerous parts of the HTML code like if

IMG SRC="javascript:alert('insecure')"

Also it appears to be possible to inject SQL into certain PHP-Nuke scripts:

http://www.nukesite.com/modules.php?name=News&file=article&sid=1234%20or%201=1

This would cause a DoS. It is likely to believe that the SQL injection could be abused to more than a mere DoS.

Solution
Most vendors will fix these issues in later versions. One should consider the risks involved in letting a third party publish things on your website without a thorough check by a trusted person.
Further details available to Secunia VIM customers

Provided and/or discovered by
Mark Grimes, Stateful Labs
Pedro Inacio
David Suzanne

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers