After a few hours of research I've found other two XSS (reflected) insertion points. More difficult to find, more satisfaction to have succeeded :) Take a look here please: http://jira.riotfamily.org/browse/RIOT-121. euronymous