Xss

[15:47:57] matt [wronka.org]/Merch Expenselink.gelco.com fail: aside from the limited password tokens to filter XSS and SQL injections, after finding an acceptable password it expires it at first logon!