I wrotte this in xoops site forums:

Do you know how to install a cockie via signature?.
I don'nt exactly how its makes, but it is posible:

Make sure that your browser configuration ask for install a cockies.

Now go to the account of "http://www.xoops.org/userinfo.php?uid=10424". You can see that ask to install cockie. If you see the html code, in the signature you can read:
This jpg file (is it really image jpg?) install cockie with format:
your_pc_user_name @ your_server_email_account.txt.

If you put this url in your browser, after try install cockie, return to page of parked domain.

i am alarmed by this, because, can any user via links (jpg is a permited extension) insert malicius code?