There is a little bug that can allow to insert html code (and maybe even
javascript) on account/verify.php, the string is not securely parsed and when
you type this kind of URL: 

http://[TheGForgePath]/account/verify.php?confirm_hash="/><p>This
must not happen</p>

you see the text down in the form "This must not happen" in a new
paragraph.

This could be used to make phising of the account (inserting a new form with
different action), putting spam texts, etc

The correction is very easy, you only need to use the htmlentities() function
with that parameter (only in the form) on the file verify.php:

Before:

<input type="hidden" name="confirm_hash"
value="<?php print $confirm_hash; ?>" />

After:

<input type="hidden" name="confirm_hash"
value="<?php print htmlentities($confirm_hash); ?>" />

This line is near from line 99 in my code (I have a modified version, so the
line could differ).

I haven't tried on this server, but I think that this server is vulnerable
too.

Affected versions are at least 4.6 but I also think that previous are
vulnerable too.