SQL Injection, Blind SQL Injection and XSS, oh my - Joomla! Forum - community, help and support

when ibm appscan enterprise 9.0.2.0 scans our joomla 3.5.1/php 5.6.9/rhel6 website reports of following problems: 1) sql injection, 2) blind sql injection , 3) cross site scripting. unless can remediate these, can't use joomla. including excerpts these reports below. i'd happy supply full report if helps. (i tried include more of report stymied illegal characters.)

there multiple reports of blind sql injection, having "return" parameter:

[high] blind sql injection
issue: 132693140
severity: high
url: https://130.14.87.95/browse-repository/software/nlp-information-extraction/named-entity-recognition/36-abner
parameter: return
risk(s): possible view, modify or delete database entries , tables
fix: review possible solutions hazardous character injection

there sql injection issue involving "option" parameter:

[high] sql injection
issue: 132571376
severity: high
url: https://130.14.87.95/index.php
parameter: option
risk(s): possible view, modify or delete database entries , tables
fix: review possible solutions hazardous character injection

and lastly, there xss issue:

[high] cross-site scripting
issue: 132569149
severity: high
url: https://130.14.87.95/browse-repository/search
parameter: searchword
risk(s): possible steal or manipulate customer session , cookies, might used impersonate legitimate user,
allowing hacker view or alter user records, , perform transactions user
fix: review possible solutions hazardous character injection

please see:
viewtopic.php?f=621&t=582860