Cross-site scripting (XSS) vulnerability in Groupmax World Wide Web (GmaxWWW) Desktop 5 6 and Desktop for Jichitai 6 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter.