CVE-2000-0746
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS)...
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
Exploit likelihood
What each source reports
NVD Score used
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
- Record
CVE-2000-0746- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
- Record
CVE-2000-0746- Updated
- 2026-11-02
EUVDEUVD-2000-0741 No score
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
- Record
EUVD-2000-0741- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-93vc-c3w9-g6c9 No score
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS)...
Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting (CSS) attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those scripts in the same context as the trusted site, aka the "IIS Cross-Site Scripting" vulnerabilities.
- Record
GHSA-93vc-c3w9-g6c9- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2000-0746 is a high vulnerability (CVSS 7.5) in Microsoft Frontpage, published September 21, 2000. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.1%, the 95th percentile. No source names a fixed version.
References
securityfocus.com/templates/archive.pike?list=1&msg=39A12BD6.E811BF4F%40nat.bg
docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-060
nvd.nist.gov/vuln/detail/CVE-2000-0746
github.com/advisories/GHSA-93vc-c3w9-g6c9