These are all from around 2013, and The Reg seems to imply that most of the vulnerabilities have been patched.
<a href="https://hubski.com//pub/379285">Discuss this on Hubski.</a>
<a onclick="_blank" href="javascript:L3f7=window.open('https://hubski.com//pub/379285');">Discuss this on Hubski.</a>
Text surrounded by asterisks (*) is italicized.
Text surrounded by plus signs (+) is bolded.
Text surrounded by vertical bars (|) is quoted. If you double-click a paragraph, it will be quoted.
Text surrounded by tildes (~) is blocked out.
Symbols such as *, +, |, and ~ can be used literally by placed a \ in front of the text.
A user's name surrounded by at signs (@) links to their profile, and the user is notified that you mentioned them.
A word surrounded by hash signs (#) becomes a tag and links to posts with that tag.
Text after a blank line that is indented by two or more spaces is reproduced verbatim in a different font.
URLs become links. However, new users cannot post links in comments.
Hubski URLS become embedded cards, displaying information about the post or comment.
Text can link to URLs by using the following format: [linked text](http://theurl.com)
Youtube, Vimeo, Soundcloud, Twitter, and Spotify urls will embed the content automatically.
Image URLs (.png, .tif, .gif, and .jpg) will embed automatically.