Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the avatar parameter.