CVE-2008-0736: Exposure of Sensitive Information to an Unauthorized Actor

admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter...

CVE-2008-0739: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/SAshipFedExMeter.asp in CandyPress CP 4.1.1.26, and earlier 4.x and 3.x versions, allows remote attackers to execute arbitrary SQL commands via the FedExAccount parameter...

CVE-2008-0739

CVE-2008-0739 describes an SQL injection in CandyPress (CP) versions 4.x/3.x, specifically in admin/SA_shipFedExMeter.asp through the FedExAccount parameter. Affected software: CandyPress CP 4.1.1.26 and earlier 4.x and 3.x. Root cause: unsafely constructed SQL queries via the FedExAccount input,...