CVE-2009-4437: Activewebsoftwares Active Auction House

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to wishlist.asp and the (2) linkid parameter to links.asp. NOTE: vector 1 might overlap CVE-2005-1029.1.

Affected products

• Activewebsoftwares Active Auction House: version 3.6 only

Published 2009-12-28. Last modified 2026-06-16.