Multiple cross-site scripting (XSS) vulnerabilities in Cherry-Design Photopad 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) datatitle parameters in an edit action to files.php or (3) id parameter in a view action to gallery.php.