CVE-2014-5098

CVE-2014-5098 affects Jamroom’s Search module up to version 1.2.1 (reported as 5.2.6 in Jamroom context). The vulnerability arises from insufficient sanitization of user-supplied data in the /search/results/ query string, enabling reflected XSS via crafted links. Impact is remote execution of arb...

CVE-2013-6804

Jamroom is affected by a Cross-Site Scripting (XSS) vulnerability in the Search module prior to version 1.1.1. The issue arises from insufficient sanitisation of the HTTP POST parameter search_string sent to /search/results/all/1/4, allowing remote attackers to inject arbitrary HTML/JavaScript. T...