← Vulnerability feed

Vulnerability record · CVE-2010-2088 · published 27 May 2010

CVE-2010-2088: Microsoft asp.net cross-site scripting vulnerability

Microsoft · Asp.Net

ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.

4.3 CVSS 2.0 Medium EPSS 9.0% · top 4.9% CWE-79 · Cross-site scripting
4.3CVSS 2.0 base score
9.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf Exploit
https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt Exploit
http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf Exploit
https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt Exploit

Track CVE-2010-2088 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2004-0847ASP.NET forms authentication bypass via backslash path traversalASP.NET forms authentication can be bypassed for .aspx files in restricted directories by sending a request containing a backslash or its encoded for…EPSS 76%analysed7.5CVE-2006-1364Microsoft ASP.NET w3wp COM component handling denial of serviceMicrosoft w3wp.exe mishandles requests for ASP.NET documents that reference COM components without the AspCompat directive, leading to uncontrolled r…EPSS 59%analysed6.8CVE-2003-0768Microsoft asp.net vulnerabilityMicrosoft ASP.Net 1.1 allows remote attackers to bypass the Cross-Site Scripting (XSS) and Script Injection protection feature via a null character i…EPSS 13%6.4CVE-2005-1664Microsoft asp.net vulnerabilityThe __VIEWSTATE functionality in Microsoft ASP.NET 1.x allows remote attackers to conduct replay attacks to (1) apply a ViewState generated from one …EPSS 19%5.0CVE-2005-2224Microsoft asp.net vulnerabilityaspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a craft…EPSS 18%5.0CVE-2005-1665Microsoft asp.net vulnerabilityThe __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU …EPSS 40%4.3CVE-2010-2084Microsoft asp.net cross-site scripting vulnerabilityMicrosoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attac…EPSS 13%4.3CVE-2005-0452Microsoft asp.net vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Microsoft ASP.NET (.Net) 1.0 and 1.1 to SP1 allow remote attackers to inject arbitrary HTML or…EPSS 23%

Source: NIST National Vulnerability Database (record CVE-2010-2088), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.