CVE-2008-0739: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and earlier 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the FedExAccount parameter...

CVE-2008-0736: Exposure of Sensitive Information to an Unauthorized Actor

admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter...