CVE-2010-4979

CANDID is reported vulnerable to an SQL Injection in image/view.php via the image_id parameter (CVE-2010-4979). The OpenVAS note corroborates that CANDID is prone to SQLi (and XSS in related checks). The CVSS base score listed is 7.5 (HIGH) with network access, low attack complexity, and no authe...

CVE-2010-4979: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in image/view.php in CANDID allows remote attackers to execute arbitrary SQL commands via the imageid parameter...

CVE-2010-4978: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the imageid parameter...

PT-2011-1913

Name of the Vulnerable Software and Affected Versions CANDID affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the image id parameter in the "image/view.php" endpoint. Recommendations At the...

PT-2011-1914

Name of the Vulnerable Software and Affected Versions CANDID affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands via the image id parameter in the "image/view.php" endpoint. Recommendations At the moment, there is no information about a...