Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmailfrom_name (2) email_sendmailfrom_address (3) email_smtpfrom_name (4) email_smtpfrom_address (5) email_smtphost (6) email_smtpport (7) jit_image_manipulationtrusted_external_sites or (8) maintenance_modeip_whitelist parameters to system/preferences.