Cross-site scripting (XSS) vulnerability in KENT-WEB CLIP-MAIL before 3.4 when Internet Explorer 7 or earlier is used allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.