Vulnerability record · CVE-2009-3735 · published 11 February 2010

CVE-2009-3735: Panda activescan code injection vulnerability

Panda · Panda Activescan

The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.

9.3 CVSS 2.0 High EPSS 5.7% · top 7.2% CWE-94 · Code injection

9.3CVSS 2.0 base score

5.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Panda Activescan Panda

References

Link	Tags
http://secunia.com/advisories/38485	Vendor Advisory
http://www.kb.cert.org/vuls/id/869993	US Government Resource
http://www.kb.cert.org/vuls/id/MAPG-7QPKL3
http://www.securityfocus.com/bid/38067
http://www.vupen.com/english/advisories/2010/0354	Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008
http://secunia.com/advisories/38485	Vendor Advisory
http://www.kb.cert.org/vuls/id/869993	US Government Resource
http://www.kb.cert.org/vuls/id/MAPG-7QPKL3
http://www.securityfocus.com/bid/38067
http://www.vupen.com/english/advisories/2010/0354	Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008

Track CVE-2009-3735 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2008-3155Panda activescan memory buffer overflow vulnerabilityStack-based buffer overflow in the ActiveX control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to cause a denial of ser…EPSS 7.7%11 Jul 2008 9.3CVE-2008-3156Panda activescan permissions and access controls vulnerabilityThe ActiveScan ActiveX Control (as2guiie.dll) in Panda ActiveScan before 1.02.00 allows remote attackers to download and execute arbitrary cabinet (C…EPSS 4.1%11 Jul 2008 7.8CVE-2007-1670Panda activescan vulnerabilityPanda Software Antivirus before 20070402 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry struc…EPSS 3.0%9 May 2007 7.5CVE-2005-3922Panda activescan vulnerabilityHeap-based buffer overflow in pskcmp.dll in Panda Software Antivirus library allows remote attackers to execute arbitrary code via a crafted ZOO arch…EPSS 5.6%30 Nov 2005 4.3CVE-2006-4295Panda activescan vulnerabilityCross-site scripting (XSS) vulnerability in ascan_6.asp in Panda ActiveScan 5.53.00 allows remote attackers to inject arbitrary web script or HTML vi…EPSS 1.8%23 Aug 2006 8.8CVE-2026-65660Microsoft sharepoint server code injection vulnerabilityImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.KEVEPSS 2.1%11 Aug 2026 9.8CVE-2026-60004Gitea diffpatch API code injection enables remote code executionGitea before 1.27.1 allows remote code execution through the diffpatch API by way of Git hook installation. The flaw is a code injection issue (CWE-9…KEVEPSS 24%analysed26 Aug 2026 9.5CVE-2026-72530TrueConf Server sandbox breakout via crafted script code injectionTrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5 and earlier allow a remote unauthenticated attacker to break o…KEVEPSS 1.7%analysed19 Aug 2026

Source: NIST National Vulnerability Database (record CVE-2009-3735), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.