We wanted to thank Narendra Bhati, who notified us about security issues in 2.5.7 (see this article about the 2.5.7.1 Security Patch).

Now that hopefully everybody updated their XOOPS installations, we wanted to list the issues reported by Narendra separately so he can submit it and get the appropriate credit:

1. Reflected XSS
2. Stored XSS
3. NO HTTP ONLY FLAG
4. Issue of improper work of Protector
5. Clickjacking

It is thanks to people like Narendra that XOOPS is improving and getting better, and we very much appreciate these contributions, as they show power of Open Source!

If you haven't yet updated your XOOPS installation, please do it ASAP!!!