Found an interesting bug, you can inject JS code ... give it a try on http://www.pssdbt.com:3000 demo
Just type <script>alert('JS Injection for the win');</script> on the chat box, it will execute for all members in the chat.
Just type <script>alert('JS Injection for the win');</script> on the chat box, it will execute for all members in the chat.