[scores.ubnt.com] DOM based XSS at form.html

How it was found

Hello,

I would like to report that the #130889 bug hasn't been fixed completely.

The removeTags function has been added, however an attacker is still able to inject Javascript as parameter values without any HTML tags:

https://scores.ubnt.com/form.html?uid=1&p=%27%20onmouseover=alert(document.domain)//

The script is triggered by the onmouseover event on the header.

Tested with latest Firefox and Chrome.