Cross-site scripting (XSS) vulnerability in the webform module in Drupal 4.6 before July 8 2006 and 4.7 before July 8 2006 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.