Multiple Cross Site Scripting (XSS) vulnerabilities in Vignette StoryServer 4 and 5 and Vignette V/5 and V/6 allow remote attackers to insert arbitrary HTML and script via text variables as demonstrated using the errInfo parameter of the default login template.