CVE-2007-2804: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 brand and 2 Msg parameters...

CVE-2006-6109: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 policy parameter in openPolicy.asp or the 2 brand parameter in prodList.asp...