webTareas through 2.1 allows XSS in clients/editclient.php extensions/addextension.php administration/add_announcement.php administration/departments.php administration/locations.php expenses/claim_type.php projects/editproject.php and general/newnotifications.php.