Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allow remote attackers to inject arbitrary web script or HTML via multiple parameters related to /users/index.htm /quarantine/spam/manage.htm /quarantine/spam/whitelist.htm /queues/mail/index/ /system/ssh.htm /queues/mail/?domain= and /quarantine/virus/manage.htm.