/admin/changeuser.php

Line 66:
PHP Code

$usertitle = get_input("usertitle","post");

Line 109-111
PHP Code

if (preg_match("/Moderator/",$user['USER_MEMBERSHIP_LEVEL'])) {
	$user_title = preg_replace("<","&lt;",$user_title);
} // end if

$usertitle vs $user_title. There's no html cleanup done that is supposed to happen if you're a moderator.

[Linked Image from siemons.org]