@robdelacruz: I have a few security-related findings for you that you might want to take a look at:

- I can inject any JavaScript in Titles, Tags and possibly other locations.

- By manually changing the value of the `userid` cookie, I can log in as any user ("1" for admin). This also allows me to access the admin section of the website.

- It's highly recommended to enable "HttpOnly" for session cookies. (Secure and SameSite should also be more strict if the application allows it)

Other remarks:

- There should be a limit on the length of submission titles, these are close to infinite it seems.

Edit: It seems others are completely defacing the board by using these tricks. I just want you to know that it's not me.