CVE-2005-2206: Elemental Software Cartwiz

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in CartWIZ allow remote attackers to modify SQL statements via the (1) idProduct parameter to tellAFriend.asp, (2) sortType parameter to viewSupportTickets.asp, or the id parameter to (3) updateCreditCards.asp or (4) deleteCreditCards.asp.

Affected products

• Elemental Software Cartwiz: any version

Published 2005-07-11. Last modified 2026-06-16.