Vulnerability record · CVE-2014-4075 · published 15 October 2014

CVE-2014-4075: Microsoft asp.net model view controller cross-site scripting vulnerability

Microsoft · Asp.Net Model View Controller

Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted web page, aka "MVC XSS Vulnerability."

4.3 CVSS 2.0 Medium EPSS 20% · top 2.6% CWE-79 · Cross-site scripting

4.3CVSS 2.0 base score

20%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References

17 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Asp.Net Model View Controller Microsoft

References

Link	Tags
http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx	Vendor Advisory
http://secunia.com/advisories/60971
http://www.securityfocus.com/bid/70352
http://www.securitytracker.com/id/1031023
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-059
http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-october-2014-security-updates.aspx	Vendor Advisory
http://secunia.com/advisories/60971
http://www.securityfocus.com/bid/70352
http://www.securitytracker.com/id/1031023
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-059

Track CVE-2014-4075 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2018-8171Microsoft asp.net core improper authentication vulnerabilityA Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature…EPSS 10%11 Jul 2018 7.5CVE-2017-0247Microsoft asp.net model view controller improper input validation vulnerabilityA denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-pa…EPSS 17%12 May 2017 7.3CVE-2017-0249Microsoft asp.net model view controller improper input validation vulnerabilityAn elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.EPSS 4.2%12 May 2017 5.3CVE-2017-0256Microsoft asp.net model view controller improper input validation vulnerabilityA spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.EPSS 3.5%12 May 2017 6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed14 May 2026 6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed23 Jun 2025 6.1CVE-2025-66376Zimbra Collaboration Classic UI stored XSS via CSS @import in emailZimbra Collaboration Suite 10 before 10.0.18 and 10.1 before 10.1.13 allows stored cross-site scripting in the Classic UI through CSS @import directi…KEVEPSS 20%analysed5 Jan 2026 6.1CVE-2025-68461Roundcube Webmail XSS via SVG animate tagRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is vulnerable to cross-site scripting through the animate tag in an SVG document. Because the f…KEVEPSS 27%analysed18 Dec 2025

Source: NIST National Vulnerability Database (record CVE-2014-4075), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.