Cross-site scripting (XSS) vulnerability in mensaje.php in C. Desseno YouTube Blog (ytb) 0.1 allows remote attackers to inject arbitrary web script or HTML via the m parameter.

More... (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3305)