BookNux 0.2 Cross Site Scripting / SQL Injection

BookNux 0.2 Vendor information: "This is an online bookmark manager. It's allow several user, share bookmark private or public. It's use php and mysql." Vendor URI: http://developer.berlios.de/projects/booknux/ Issues: SQL Injection, Cross Site Scripting Risk-level: High...