Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email (2) cond or (3) name parameters to (a) addressbook.view.php (4) the daysprune parameter to (b) index.php (5) the datato parameter to (c) compose.email.php and (6) the markas parameter to (d) read.markas.php.