CVE-2006-6109

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-11-26 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.

Affected products

Candypress Store: 3.5.2.14

References

http://marc.info/?l=bugtraq&m=116372253323469&w=2
http://s-a-p.ca/index.php?page=OurAdvisories&id=25
http://secunia.com/advisories/22954
http://www.securityfocus.com/bid/21090/info
http://www.vupen.com/english/advisories/2006/4577
https://exchange.xforce.ibmcloud.com/vulnerabilities/30346
http://marc.info/?l=bugtraq&m=116372253323469&w=2
http://s-a-p.ca/index.php?page=OurAdvisories&id=25
http://secunia.com/advisories/22954
http://www.securityfocus.com/bid/21090/info
http://www.vupen.com/english/advisories/2006/4577
https://exchange.xforce.ibmcloud.com/vulnerabilities/30346

Get alerted when CVE-2006-6109 or the next vulnerability affects your stack