CVE-2006-1257
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow...
CVE-2006-1257 is a high vulnerability (CVSS 7.5) in Microsoft Commerce Server, published March 19, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.3%, the 98th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 30.3%EPSS, 98th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
Exploit likelihood
Affected products
What each source reports
NVD Score used
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
CVE-2006-1257- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
CVE-2006-1257- Updated
- 2026-11-02
EUVDEUVD-2006-1261No score
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
EUVD-2006-1261- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j7hg-4m8w-qjr3No score
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow...
The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.
- Record
GHSA-j7hg-4m8w-qjr3- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exchange.xforce.ibmcloud.com/vulnerabilities/25330
securityreason.com/securityalert/594
msdn.microsoft.com/library/default.asp?url=/library/en-us/csvr2002/htm/cs_se_securityconcepts_cbgw.asp
osvdb.org/24121
securityfocus.com/bid/17134
nvd.nist.gov/vuln/detail/CVE-2006-1257
github.com/advisories/GHSA-j7hg-4m8w-qjr3