CVE-2011-2155
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword...
CVE-2011-2155 is a high vulnerability (CVSS 7.5) in Smartertools Smarterstats, published May 20, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.91%, the 90th percentile. No source names a fixed version.
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.
Exploit likelihood
What each source reports
NVD Score used
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.
- Record
CVE-2011-2155- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.
- Record
CVE-2011-2155- Updated
- 2026-11-02
EUVDEUVD-2011-2147 No score
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.
- Record
EUVD-2011-2147- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f3pr-496c-8q45 No score
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword...
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation.
- Record
GHSA-f3pr-496c-8q45- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
exchange.xforce.ibmcloud.com/vulnerabilities/67827
kb.cert.org/vuls/id/MORO-8GYQR4
nvd.nist.gov/vuln/detail/CVE-2011-2155
github.com/advisories/GHSA-f3pr-496c-8q45