https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2008-6663.htmlhttps://patchthecve.com/cve/CVE-2008-6663.htmlTue, 16 Jun 2026 23:02:43 +0000HIGH 7.5: SQL injection vulnerability in profile.php in PHPAuctions.info PHPAuctions (aka PHPAuctionSystem) allows remote attackers to execute arbitrary SQL commands via the auction_id parameter, a different vector than CVE-2009-0106.https://patchthecve.com/cve/CVE-2009-0108.htmlhttps://patchthecve.com/cve/CVE-2009-0108.htmlTue, 16 Jun 2026 23:04:16 +0000HIGH 7.5: PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID, (2) PHPAUCTION_RM_NAME, (3) PHPAUCTION_RM_USERNAME, and (4) PHPAUCTION_RM_EMAIL cookies.https://patchthecve.com/cve/CVE-2009-0107.htmlhttps://patchthecve.com/cve/CVE-2009-0107.htmlTue, 16 Jun 2026 23:04:16 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.https://patchthecve.com/cve/CVE-2009-0106.htmlhttps://patchthecve.com/cve/CVE-2009-0106.htmlTue, 16 Jun 2026 23:04:16 +0000HIGH 7.5: SQL injection vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to execute arbitrary SQL commands via the user_id parameter.