Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2 and 4.7.x before 4.7.7 (1) allow remote attackers to inject arbitrary web script or HTML via \some server variables \ including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.