Multiple cross-site scripting (XSS) vulnerabilities in (1) acid_qry_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (2) base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.2 and unspecified other console scripts in these products allow remote attackers to inject arbitrary web script or HTML via the sig1 parameter and possibly other parameters a different vulnerability than CVE-2007-6156.