Multiple cross-site scripting (XSS) vulnerabilities in PRO-Search 0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prot (2) host (3) path (4) name (5) ext (6) size (7) search_days or (8) show_page parameter to the default URI.