Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5.8 and 10.6 before 10.6.4 allows remote authenticated users to inject arbitrary web script or HTML via crafted Wiki content related to lack of a charset field.