SimpleRisk is an open-source risk management system released under Mozilla Public License and used for risk management activities. It enables risk managers to account for risks, plan mitigation measures, facilitate management reviews, prioritize for project planning, and track periodic reviews.
SimpleRisk suffers from two reflected cross-site scripting vulnerabilities when input passed via 'draw' POST parameter and the 'PHP_SELF' variable is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.