I haven't used Basecamp in a while, but I was distressed to discover this when screwing around with HTML in todo lists a while back. I could put arbitrary Java

I haven't used Basecamp in a while, but I was distressed to discover this when screwing around with HTML in todo lists a while back. I could put arbitrary JavaScript in the todo element, and I verified that it would execute when run by another user. Combine that with plain text password reset and you just got pwnd bad.