Multiple cross-site scripting (XSS) vulnerabilities in Jupiter CMS allow remote attackers to inject arbitrary web script or HTML via the (1) languageAdmin name and (2) languageAdmin back parameters in (a) modules/blocks.php; the (3) languageRegister title and (4) languageRegister title2 parameters in (b) modules/register.php; the (5) languageMass-Email form title (6) languageMass-Email form desc (7) languageMass-Email form desc2 (8) languageMass-Email form desc3 and (9) languageMass-Email form desc4 parameters in (c) modules/mass-email.php; the (10) languageForgotten title (11) languageForgotten desc (12) languageForgotten desc2 (13) languageForgotten desc3 (14) languageForgotten desc4 and (15) languageForgotten desc5 parameters in (d) modules/register.php; and the (16) languageSearch view desc (17) languageSearch view desc2 (18) languageSearch view desc3 (19) languageSearch view desc4 (20) languageSearch view desc5 (21) languageSearch view desc6 (22) languageSearch view desc7 and (23) languageSearch view desc8 parameters in (e) modules/search.php.