Cross-site scripting vulnerability in Slash before 2.2.5 as used in Slashcode and elsewhere allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL possibly in the formkey field.