CVE-2007-6466: Freewebshop

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the prod parameter in a details action, (2) the cat parameter in a browse list action, or (3) the group parameter in a categories action. NOTE: it was later reported that MOG - Web Shop (MOG-WebShop), a product based on the same code, is also affected.

Affected products

• Freewebshop Freewebshop: version 2.2.1 only

Published 2007-12-20. Last modified 2026-06-16.