The Horde and Kronolith Calendar applications suffer from multiple cross site scripting vulnerabilities.