Cross-site scripting vulnerability in Double Choco Latte (DCL) before 20020706 allows remote attackers to inject arbitrary HTML including script into web pages via the (1) Ticket# Find (2) Priorities (3) Severities (4) Projects (5) WO# Find (6) Departments and (7) Users features.