Multiple cross-site scripting (XSS) vulnerabilities in Brad Fears phpCodeCabinet 0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple parameters including (1) the sid parameter to comments.php (2) the cid cf or rfd parameters to category.php or the cid parameter to (3) input.php (4) browse.php (5) themes/facade/header.php or (6) themes/phpcc/header.php.