mt-comments.cgi in Movable Type before 3.2 allows attackers to redirect users to other web sites via URLs in comments.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2005-3104
http://secunia.com/advisories/16899
http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0091.html