Multiple cross-site scripting (XSS) vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) account.php (2) moresmiles.php or (3) recover.php; or (4) the \to\ parameter to usercp.php.