Multiple cross-site scripting (XSS) vulnerabilities in Michael Salzer Guestbox 0.6 and other versions before 0.8 allow remote attackers to inject arbitrary web script or HTML via (1) HTML tags that follow a \http://\ string which bypasses a regular expression check and (2) other unspecified attack vectors.