How can this possibly even work too. The CSS is within a stylesheet or within a <style> block. Unless the thread title is placed inside the CSS somewhere...

I was asking myself the same thing...

probably the site attacked was not clossing container tags and did not close the <style> tag. it probably wasnt an exploit just bad coding on the website's end. just another reason to follow standards and to validate your pages.

either way, wouldn't it require
*/ $thread['title'] /*

Is this a 3.6 only exploit, because my 3.5.x board works fine through the "break".

Kirk,
no, this is not an exploit in vbulletin

I agree with the above comments ... it's just bad coding on the website's end (not default style)

Okay, that figures. Thanks Princeton.