smf for years have had bad problems with attacks run from images, can't understand why they have never beefed it up, they just seem to do half hearted fixes all the time, with all free ware boards though never allow attachments, that is there weakest point, for avatars and uploading them there should be a rewrite script which cleans any text off and rewrites it as say smf avatar username, worth downloading if smf has it.
