Hi Steve and thanks for starting this group. I've recently become aware
that shopzone is susceptible to Cross Site Scripting. For example, try
this link:

http://www.kci2.com/st_main.html?Submit=abc123&catid="><script>alert
(document.cookie)</script>

I've tried contacting automatedshops.com, however they seem to be in
some kind of transition, and not too keen on updated the webc code.
Does anyone has any ideas to filter the input/output to prevent this
possibility?