Multiple reflected cross-site scripting (XSS) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 version 1.10. These vulnerabilities allow an attacker to execute arbitrary JavaScript code by crafting a malicious URL that triggers reflected XSS via error messages for non-existing page requests.