Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as \onmouseover\ in the (1) smile_url or (2) smile_emotion parameters which bypasses a check for \<\ and \>\ characters.