Create-Project Manager version 1.07 suffers from cross site scripting and html injection vulnerabilities.