Most of user defined data in Vanilla Guestbook 1.0 beta is not properly sanitized leading to SQL injection and XSS problems.