Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.
The images in this directory are copyright (C) 2007 Dan Fuhry. Except
as permitted by applicable law, they may not be used in any way other
than to promote the unmodified Enano CMS. You also may not modify and
then distribute the images in this directory, or distribute them sep-
arately from the Enano packages. The goal here is to establish a uni-
que identity for Enano through the use of a logo, and that identity
would be confused if this logo is used for unofficial Enano distros.