Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the message sending and user input fields.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)