CVE-2008-0736

admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter...

CVE-2008-0738

CandyPress (CP) versions 4.1.1.26 and earlier 4.1.x are affected by multiple SQL injection vulnerabilities. Attack vectors involve user-supplied parameters: (1) idcust passed to ajax_getTiers.asp and ajax_getCust.asp in the ajax/ directory, and (2) tableName passed to ajax/ajax_tableFields.asp. T...

CVE-2008-0738

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idcust parameter to a ajaxgetTiers.asp and b ajaxgetCust.asp in ajax/, and the 2 tableName parameter to c ajax/ajaxtableFields.asp. NOTE...

CVE-2008-0739

CVE-2008-0739 describes an SQL injection in CandyPress (CP) versions 4.x/3.x, specifically in admin/SA_shipFedExMeter.asp through the FedExAccount parameter. Affected software: CandyPress CP 4.1.1.26 and earlier 4.x and 3.x. Root cause: unsafely constructed SQL queries via the FedExAccount input,...

CVE-2008-0737: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/utilitiesConfigHelp.asp in CandyPress CP 4.1.1.26, and other 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the helpfield parameter...

CVE-2008-0739

SQL injection vulnerability in admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and earlier 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the FedExAccount parameter...

CVE-2008-0739: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and earlier 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the FedExAccount parameter...

CVE-2008-0737

SQL injection vulnerability in admin/utilitiesConfigHelp.asp in CandyPress CP 4.1.1.26, and other 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the helpfield parameter...

CVE-2008-0736: Exposure of Sensitive Information to an Unauthorized Actor

admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter...

CVE-2008-0737

CVE-2008-0737 is a SQL injection vulnerability in CandyPress (CP) 4.x/3.x, exploitable via the ASP script admin/utilities_ConfigHelp.asp. The vulnerability stems from insufficient sanitization of the helpfield parameter, allowing an unauthenticated attacker to modify database queries to disclose ...

CVE-2008-0736

CVE-2008-0736 affects CandyPress (CP) 4.1.1.26 and possibly other 4.x and 3.x versions. The vulnerability is in admin/SA_shipFedExMeter.asp, where a crafted FedExAccount parameter value enables a path traversal, allowing remote attackers to obtain the server path. Impact is partial confidentialit...

CVE-2008-0738: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idcust parameter to a ajaxgetTiers.asp and b ajaxgetCust.asp in ajax/, and the 2 tableName parameter to c ajax/ajaxtableFields.asp. NOTE...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/utilitiesConfigHelp.asp in CandyPress CP 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter...

CVE-2008-0546

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idProduct and 2 options parameters to a ajax/ajaxoptInventory.asp, or the 2 recid parameter to b ajax/ajaxgetBrands.asp...

CVE-2008-0547

Cross-site scripting XSS vulnerability in admin/utilitiesConfigHelp.asp in CandyPress CP 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter...

Sql injection

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idProduct and 2 options parameters to a ajax/ajaxoptInventory.asp, or the 2 recid parameter to b ajax/ajaxgetBrands.asp...

CVE-2008-0547

Cross-site scripting XSS vulnerability in admin/utilitiesConfigHelp.asp in CandyPress CP 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter...

CVE-2008-0546

The CVE-2008-0546 entry concerns CandyPress (CP) 4.1.1.26 and earlier 4.1.x, which contains multiple SQL injection vulnerabilities. The affected components are the AJAX endpoints: (a) ajax/ajax_optInventory.asp (parameters idProduct and options) and (b) ajax/ajax_getBrands.asp (parameter recid). ...

CVE-2008-0547

CVE-2008-0547 is a cross-site scripting (XSS) vulnerability in CandyPress (CP) 4.1.1.26 and probably earlier 4.x and 3.x versions. It affects the admin/utilities_ConfigHelp.asp page where the helpfield parameter can be exploited by remote attackers to inject arbitrary web script or HTML. The issu...

CVE-2008-0546

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idProduct and 2 options parameters to a ajax/ajaxoptInventory.asp, or the 2 recid parameter to b ajax/ajaxgetBrands.asp...