Cross-site scripting (XSS) vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) return_url parameter to modules\\com_vtiger_workflow\\savetemplate.php or unspecified vectors to (2) deletetask.php (3) edittask.php (4) savetask.php or (5) saveworkflow.php.