CVE-2008-0547: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/utilitiesConfigHelp.asp in CandyPress CP 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter...

CVE-2008-0546: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in CandyPress CP 4.1.1.26, and earlier 4.1.x versions, allow remote attackers to execute arbitrary SQL commands via the 1 idProduct and 2 options parameters to a ajax/ajaxoptInventory.asp, or the 2 recid parameter to b ajax/ajaxgetBrands.asp...

CandyPress Store admin/utilities_ConfigHelp.asp helpfield Parameter SQL Injection

The remote host is running CandyPress, a commercial shopping cart script written in ASP. The version of CandyPress installed on the remote host fails to sanitize user-supplied input to the 'helpfield' parameter of the 'admin/utilitiesConfigHelp.asp' script before using it to perform database...

candypress-multi.txt

WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26 Exploit: Available Fix Available: Yes!, Update to 4.1.1.27...

CandyPress eCommerce suite 4.1.1.26 Multiple Remote Vulnerabilities

No description provided by source. WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26 Exploit: Available Fix Available:...

CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities

CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26...

[CandyPress] eCommerce suite (SQL Injection + XSS + Path Disclosure)

WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26 Exploit: Available Fix Available: Yes!, Update to 4.1.1.27...

CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities

WwW.BugReport.ir AmnPardaz Security Research & Penetration Testing Group Title: CandyPress eCommerce suite Vendor: http://www.candypress.com/ Bugs: SQL Injection + XSS + Path Disclosure in CandyPress Vulnerable Version: 4.1.1.26 Exploit: Available Fix Available: Yes!, Update to 4.1.1.27...

CandyPress eCommerce suite 4.1.1.26 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications =================================================================== CandyPress eCommerce suite 4.1.1.26 Multiple Remote Vulnerabilities =================================================================== AmnPardaz Security Research &...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2007-2804. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2007-5629

Cross-site scripting XSS vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2007-2804. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2007-5629

CVE-2007-5629 describes a cross-site scripting (XSS) vulnerability in ShoppingTree CandyPress Store 4.1, specifically in admin/logon.asp, where an attacker can inject arbitrary script/HTML via the msg parameter. The entry notes this as a different vector than CVE-2007-2804. The connected document...

CVE-2007-5629

Cross-site scripting XSS vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2007-2804. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2007-5629: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter, a different vector than CVE-2007-2804. NOTE: the provenance of this information is unknown; the details are obtained...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 brand and 2 Msg parameters...

CVE-2007-2804

Multiple cross-site scripting XSS vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 brand and 2 Msg parameters...

CVE-2007-2804

Multiple cross-site scripting XSS vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 brand and 2 Msg parameters...

CVE-2007-2804

CVE-2007-2804: Multiple XSS vulnerabilities in CandyPress Store 3.5.2.14 and earlier. Affected component: scripts/prodList.asp. Vulnerable vectors: (1) brand and (2) Msg parameters. Remote attackers can inject arbitrary web script or HTML.

CVE-2007-2804: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 brand and 2 Msg parameters...

CandyPress™ Store XSS vuln.

Vuln. discovered by : r0t Date: 18 May 2007 vendor:http://www.candypress.com/ affected versions: v3.5.2.14 and prior CandyPress™ Store contains a flaw that allows a remote Cross-Site Scripting attacks.Input passed to the "brand" and "Msg" parameter in "scripts/prodList.asp" isn't properly sanitis...