Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1 when Global Script Protection is not enabled allows remote attackers to inject arbitrary HTML and web script via unknown vectors possibly related to Linkdirect.cfm Topnav.cfm and Welcomedoc.cfm.