CVE-2006-1257
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow...
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
Exploit likelihood
What each source reports
NVD Score used
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
CVE-2006-1257- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
CVE-2006-1257- Updated
- 2026-11-02
EUVDEUVD-2006-1261 No score
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
EUVD-2006-1261- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j7hg-4m8w-qjr3 No score
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow...
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
GHSA-j7hg-4m8w-qjr3- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1257 is a high vulnerability (CVSS 7.5) in Microsoft Commerce Server, published March 19, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.3%, the 98th percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/25330
securityreason.com/securityalert/594
msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp
osvdb.org/24121
securityfocus.com/bid/17134
nvd.nist.gov/vuln/detail/CVE-2006-1257
github.com/advisories/GHSA-j7hg-4m8w-qjr3