Multiple cross-site scripting (XSS) vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) brand and (2) Msg parameters.
CPE | Name | Operator | Version |
---|---|---|---|
candypress_store | le | 3.5.2.14 |