Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors possibly including (1) calendar/myagenda.php (2) document/document.php (3) phpbb/newtopic.php (4) tracking/userLog.php and (5) wiki/page.php.