SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skilledit[] parameter.
SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitrary SQL commands via the releaseid parameter.
Cross-site scripting (XSS) vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter.