Question: On a page from a website (one of ours) I can enter in the url the following code:

```
javascript:createNewWindow('Something', 100, 100, 'Text')

```

Is there a way someone can exploit this?

```
function createNewWindow(url, widthIn, heightIn, title) 
        {
            var strOptions='toolbar=0,location=0,directories=0,status=1,menubar=0,scrollbars=1,resizable=1,width=' + widthIn + ',height=' + heightIn;
            var newWin = open( url,title,strOptions ); 
            newWin.focus();
        }

```

Answer: 
Given that code, the createNewWindow() script isn't any more vulnerable than the raw javascript.
In general javascript running on your site is not the source of vulnerabilities. You should be worrying about the server side of the application.

However! You can introduce vulnerabilities into your site using javascript. Its called [DOM Based XSS](http://www.owasp.org/index.php/DOM_Based_XSS). The code you posted isn't vulnerable to DOM Based XSS.