CVE:CVE-2007-2804
CNNVD:CNNVD-200705-430
CandyPress Store 的scripts/prodList.asp中存在多个跨站脚本攻击漏洞。远程攻击者可以借助(1)brand和(2)Msg参数，注入任意的web脚本或HTML。
solution:Upgrade candypress candypress_store to a higher version than 3.5.2.14,and avoid the version (,3.5.2.14]