Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in KAPhotoservice 7.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 New Category newcategory or 2 apage parameter to a edtalbum.asp, or the 3 cat or 4 albumid parameter to b album.asp...