Cross-site scripting (XSS) vulnerability in phpspot PHP BBS PHP Image Capture BBS PHP & CSS BBS PHP BBS CE PHP_RSS_Builder and webshot dated before 20090914 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to cookies.