Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via the (1) Taaa parameter to (a) up.php or the (2) pollhtml and (3) Bloks parameters to (b) polls.php different vectors than CVE-2006-5770.