Multiple cross-site scripting (XSS) vulnerabilities in SMEWeb 1.4b and 1.4f allow remote attackers to inject arbitrary web script or HTML via the (1) data parameter to catalog.php the (2) keyword parameter to search.php the (3) page parameter to bb.php and the (4) new_s parameter to order.php.