Multiple cross-site scripting (XSS) vulnerabilities in Oliver Library Management System allow remote attackers to inject arbitrary web script or HTML via the (1) updateform and (2) displayform parameter to (a) gateway/gateway.exe; the (3) TERMS (4) database (5) srchad (6) SuggestedSearch and (7) searchform parameters to the (b) \Basic Search page\; and (8) username parameter when (c) logging on.