Cross Site Scripting (XSS) in the \admin_boxes.ajax.php\ component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the \cID\ parameter when creating a new HTML component.