Multiple cross-site scripting (XSS) vulnerabilities in phpSQLiteCMS 1 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) langhome (2) langadmin_menu and (3) langadmin_menu_page_overview parameters to cms/includes/header.inc.php; and the (4) langlogin_username and (5) langlogin_password parameters to cms/includes/login.inc.php.