Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfgprojectName parameter to index.php/admin/saveConfig the (2) datastats_provider_url parameter to index.php/areas/saveArea or the (3) datadescription parameter to index.php/areas/saveSection.