Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) kp3 (2) type (3) msg (4) forum_id (5) pos (6) cats_app (7) cat_id (8) msgballmsgnum (9) fldballacctnum parameters to index.php or (10) ticket_id to viewticket_details.php.