** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in BluePay Manager 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML during a login action via the (1) Account Name and (2) Username field. NOTE: the vendor has disputed this vulnerability saying that \it does not exist currently in the Bluepay 2.0 product \ and older versions might not have been affected either. As of 20060512 CVE has not formally investigated this dispute.