Jamroom is a modestly sized, open-source content-management and social-networking platform that occupies a niche but recognized position in the vulnerability landscape. Its disclosures concentrate in the core Jamroom product and its search module, recur through application-layer weaknesses including cross-site scripting, code injection, authentication flaws, and path traversal, and show a strong tendency toward public exploit availability. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jamroom over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-2886HIGH PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when register_globals is enabled, allows remote attackers to execu | Jun 27, 2008 | 9.3 | 34 | NO | YES |
CVE-2008-3375HIGH The jrCookie function in includes/jamroom-misc.inc.php in JamRoom before 3.4.0 allows remote attackers to bypass authentication and gain administrative access via a boolean value w | Jul 30, 2008 | 7.5 | 31 | NO | YES |
CVE-2008-3376HIGH Multiple unspecified vulnerabilities in JamRoom before 3.4.0 have unknown impact and attack vectors. | Jul 30, 2008 | 10.0 | 29 | NO | NO |
CVE-2008-2883HIGH PHP remote file inclusion vulnerability in include/plugins/jrBrowser/payment.php in Jamroom 3.3.0 through 3.3.5 allows remote attackers to execute arbitrary PHP code via a URL in t | Jun 26, 2008 | 7.5 | 28 | NO | YES |
CVE-2009-1318MEDIUM Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows remote attackers to include arbitrary f | Apr 17, 2009 | 6.5 | 26 | NO | YES |
CVE-2006-5060MEDIUM Cross-site scripting (XSS) vulnerability in login.php in Jamroom 3.0.16 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the forgot parameter | Sep 28, 2006 | 5.1 | 23 | NO | YES |
CVE-2010-2463MEDIUM Cross-site scripting (XSS) vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter in a modify a | Jun 25, 2010 | 4.3 | 22 | NO | YES |
CVE-2012-6705MEDIUM Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field. | Jun 4, 2017 | 6.1 | 21 | NO | NO |
CVE-2013-6804MEDIUM Cross-site scripting (XSS) vulnerability in the Search module before 1.1.1 for Jamroom allows remote attackers to inject arbitrary web script or HTML via the search_string paramete | Dec 5, 2013 | 4.3 | 18 | NO | NO |
CVE-2014-5098MEDIUM Cross-site scripting (XSS) vulnerability in the Search module before 1.2.2 in Jamroom allows remote attackers to inject arbitrary web script or HTML via the query string to search/ | Oct 20, 2014 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jamroom.
Media articles that mention a CVE ID that affects a product developed by Jamroom — matched by CVE ID, not by vendor name.