If anyone is curious, these security holes were found in dynamically generated javascript that included a GET parameter that was neither encoded nor run through magic_quotes. They were easy to find to the point where an automated scanning tool could almost certainly identify them.