Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7 i-doit pro 1.0 and earlier and i-doit pro 1.0.2 when the 'sanitize user input' flag is not enabled allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.