Multiple cross-site scripting (XSS) vulnerabilities in ACP3 4.0 beta 3 allow remote attackers to inject arbitrary web script or HTML via (1) the formmail parameter to contact/contact/index.php; the (2) formmods or (3) formsearch_term parameter to search/list/action_search/index.php; (4) the id parameter to modules/dl/download.php; (5) the formcat parameter to news/list/index.php; the (6) formcat (7) formname or (8) formmessage parameter to certain news/details/id_*/action_create/index.php files; or (9) the formmail parameter to newsletter/create/index.php.