Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.4.3 and 1.5 RC 1 allow remote attackers to inject arbitrary web script or HTML via the (1) showcourse parameter to browse.php, (2) subject parameter to contact.php, (3) cid parameter to content.php, (4) l parameter to inbox/sendmessage.php, the (5) search, (6) words, (7) include, (8) findin, (9) displayas, or (10) search parameter to search.php, the (11) submit, (12) query, or (13) field parameter to tile.php, the (14) us parameter to forum/subscribeforum.php, or the (15) roles[], (16) status, (17) submit, or (18) resetfilter parameters to directory.php.