http://bugs.processmaker.com/view.php?id=11072

BUG 11072 "Users are allowed to inject code (XSS)in the forgot..." SOLVED
- Users are allowed to inject code (XSS)in the forgot Password login form
- Problem solved, was encoded field UserName HTML characters,  when the user performs forgotpassword
* Available from version ProcessMaker-2.0.47 (2.5.1)