CVE-2009-2386

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attackers to force the download and execution of arbitrary files via the GetURL method.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2009
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2009

CVE-2009-23874.9Unspecified vulnerability in the proc filesystem in Sun OpenSolaris snv_49 through snv_109 allows local users to cause a denial of service (CVE-2009-23886.8SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword paCVE-2009-23896.8Multiple SQL injection vulnerabilities in newsscript.php in USOLVED NEWSolved 1.1.6, when magic_quotes_gpc is disabled, allow remote attackeCVE-2009-23907.5SQL injection vulnerability in the BookFlip (com_bookflip) component 2.1 for Joomla! allows remote attackers to execute arbitrary SQL commanCVE-2009-23914.3Cross-site scripting (XSS) vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to inject arbitrary CVE-2009-23927.5SQL injection vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to execute arbitrary SQL commandsCVE-2009-23936.5admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remote authenticated useCVE-2009-23947.5SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allows remote attackers tCVE-2009-23957.5SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to execute arbitrary SQLCVE-2009-23969.3PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remoteCVE-2009-23975.0Directory traversal vulnerability in download.php in Audio Article Directory allows remote attackers to read arbitrary files via directory tCVE-2009-23985.0Directory traversal vulnerability in test/index.php in PHP-Sugar 0.80 allows remote attackers to read arbitrary files via a ..// (dot dot sl
CVE-2009-2386: Critical severity, CVSS 9.3 | Vulnix