TaskFreak! suffers from multiple XSS vulnerabilities when parsing input to multiple parameters in different scripts. The vulnerable POST parameters are: ‘sContext’, ‘sort’, ‘dir’ and ‘show’ thru index.php. Also the GET parameters ‘dir’ and ‘show’ thru ‘print_list.php’ are vulnerable. Header variable ‘referer’ is vulnerable thru rss.php script. Attackers can exploit these weaknesses to execute arbitrary HTML and script code in a user’s browser session.