Jennifer Bornholt

Name of the Vulnerable Software and Affected Versions: Jomres (com jomres) versions prior to 7.3.1 for Joomla! Description: A cross-site scripting (XSS) issue allows remote authenticated users with the "Business Manager" permission to inject arbitrary web script or HTML via the `property name` parameter, related to editing property details. Recommendations: For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `property name` parameter when editing property details until the update is applied.

Name of the Vulnerable Software and Affected Versions: Jomres (com jomres) versions prior to 7.3.1 for Joomla! Description: The issue allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the `id` parameter in an `editProfile` action to "administrator/index.php". This is a SQL injection vulnerability. Recommendations: For versions prior to 7.3.1, update to version 7.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `editProfile` action in the administrator/index.php file to minimize the risk of exploitation. Avoid using the `id` parameter in the affected API endpoint until the issue is resolved.