Description
A cross-site scripting (XSS) vulnerability exists in Mjguest through the "level" parameter. The parameter is not properly sanitized before being rendered in HTML output.
Impact
Attackers can inject malicious JavaScript that executes when other users view the guestbook, enabling session hijacking and credential theft.
Solution
Apply proper output encoding to the level parameter. Validate all user input.