Prerequisites for experience this vulnerability are not really on the tough side, i.e. it works with a usual browser. I was successful with Chrome 0/0 and Firefox 0.0 (both under Linux) as well as IE 0 (Win 0/Vista):Not all search results work, in this example for the German book only the first XSS "flies". More on this below.Note that the second search result of this book has a (double) iframe on p000 with UTF-0 encoding (w/o any). Unfortunately the PHP script referred by the iframe doesn't exist currently. There's a good chance that this would work otherwise (hey Mario: how 'bout putting the file online? ;-))