Jara 1.6 has a SQL injection vulnerability.
Jara
Exploit
CVE-2011-4094
NVD
Refer to CVE-2011-4094 NVD advisory