CVE-2015-0072
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows...
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
- Record
CVE-2015-0072- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
- Record
CVE-2015-0072- Updated
- 2026-11-02
EUVDEUVD-2015-0110 No score
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
- Record
EUVD-2015-0110- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w5f7-x6mf-vc7q No score
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows...
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
- Record
GHSA-w5f7-x6mf-vc7q- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection | 2015-02-01 |
| PoC in GitHub | dbellavista/uxss-poc | 2015-02-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0072 is a medium vulnerability (CVSS 4.3) in Microsoft Internet Explorer, published February 7, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 71.7%, the 99th percentile. No source names a fixed version.
References
secunia.com/advisories/62658
docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
securitytracker.com/id/1031888
community.websense.com/blogs/securitylabs/archive/2015/02/05/another-day-another-zero-day-internet-explorer-s-turn-cve-2015-0072.aspx
nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scripting-zero-day-bug
pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerful-phishing-attacks.html
Show 8 moreShow less
innerht.ml/blog/ie-uxss.html
securityfocus.com/archive/1/534662/100/0/threaded
packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-Proof-Of-Concept.html
seclists.org/fulldisclosure/2015/Feb/0
exchange.xforce.ibmcloud.com/vulnerabilities/100606
nvd.nist.gov/vuln/detail/CVE-2015-0072
github.com/advisories/GHSA-w5f7-x6mf-vc7q