Vulnerability Database

317,019

Total vulnerabilities in the database

CVE-2006-6109

Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.

  • Published: Nov 26, 2006
  • Updated: Nov 9, 2025
  • CVE: CVE-2006-6109
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
candypress / candypress_store 3.5.2.14 3.5.2.14.x