Multiple reflected cross-site scripting (XSS) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 version 1.10. These vulnerabilities allow an attacker to craft a malicious URL that can execute arbitrary JavaScript code when visited by a user. This could lead to session hijacking or other client-side attacks. The vulnerabilities have a high severity rating with a CVSS score of 7.4.