Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG tag.