Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collectiondescription parameter to upload/managecollections.php in an addnew action or the (2) photodescription, (3) phototags, or (4) phototitle parameter to upload/actions/photouploader.php.