Multiple cross-site scripting (XSS) vulnerabilities in admin/header.php in Toms Gaestebuch 1.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) langadminseite (2) langueberschrift or (3) einstmetachar parameter different vectors than CVE-2007-4711.