Multiple cross-site scripting (XSS) vulnerabilities in odCMS 1.06 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the Page parameter to (1) _main/index.php (2) _members/index.php (3) _forum/index.php (4) _docs/index.php and (5) _announcements/index.php.