← Vulnerability feed

Vulnerability record · CVE-2005-0452 · published 16 February 2005

CVE-2005-0452: Microsoft asp.net vulnerability

Microsoft · Asp.Net

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".

4.3 CVSS 2.0 Medium EPSS 23% · top 2.3%
4.3CVSS 2.0 base score
23%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
16 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or web script via Unicode representations for ASCII fullwidth characters that are converted to normal ASCII characters, including ">" and "<".

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml Vendor Advisory
http://marc.info/?l=bugtraq&m=110867912714913&w=2
http://secunia.com/advisories/14214 Vendor Advisory
http://www.securityfocus.com/bid/12574 Vendor Advisory
http://it-project.ru/andir/docs/aspxvuln/aspxvuln.en.xml Vendor Advisory
http://marc.info/?l=bugtraq&m=110867912714913&w=2
http://secunia.com/advisories/14214 Vendor Advisory
http://www.securityfocus.com/bid/12574 Vendor Advisory

Track CVE-2005-0452 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2004-0847ASP.NET forms authentication bypass via backslash path traversalASP.NET forms authentication can be bypassed for .aspx files in restricted directories by sending a request containing a backslash or its encoded for…EPSS 76%analysed7.5CVE-2006-1364Microsoft ASP.NET w3wp COM component handling denial of serviceMicrosoft w3wp.exe mishandles requests for ASP.NET documents that reference COM components without the AspCompat directive, leading to uncontrolled r…EPSS 59%analysed6.8CVE-2003-0768Microsoft asp.net vulnerabilityMicrosoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting (XSS) and Script Injection protection feature via a null character i…EPSS 13%6.4CVE-2005-1664Microsoft asp.net vulnerabilityThe __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one …EPSS 19%5.0CVE-2005-2224Microsoft asp.net vulnerabilityaspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a craft…EPSS 18%5.0CVE-2005-1665Microsoft asp.net vulnerabilityThe __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU …EPSS 40%4.3CVE-2010-2084Microsoft asp.net cross-site scripting vulnerabilityMicrosoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attac…EPSS 13%4.3CVE-2010-2088Microsoft asp.net cross-site scripting vulnerabilityASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS)…EPSS 9.0%

Source: NIST National Vulnerability Database (record CVE-2005-0452), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.