Multiple cross-site scripting (XSS) vulnerabilities in aWebBB 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) tname or (2) fpost parameters to (a) post.php; (3) fullname (4) emailadd (5) country (6) sig or (7) otherav parameters to (b) editac.php; or (8) fullname (9) emailadd or (10) country parameters to (c) register.php.