Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3 in the index.php admin login webpage (with different request parameters) allows remote attackers to inject arbitrary web script or HTML.