Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML via the (1) path parameter to view/search/; or the (2) companyname (3) country (4) email (5) firstname (6) middlename (7) required (8) surname or (9) title parameter to view/supplynews/.