Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inject arbitrary web script and HTML via the (1) busername and (2) c parameters to (a) index.php the busername parameter to (b) admin/index.php and (3) cphone parameter to register.php.