Multiple cross-site scripting (XSS) vulnerabilities in HydroBB 1.0.0 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to (1) search.php (2) members.php (3) stats.php (4) viewforum.php (5) register.php (6) usercp.php (7) groups.php (8) pms.php and (9) calendar.php.