CVE-2005-2678NVD

Vulnerability Summary

Microsoft IIS 5.1 and 6 allows remote attackers to spoof the SERVER_NAME variable to bypass security checks and conduct various attacks via a GET request with an http://localhost URI, which makes it appear as if the request is coming from localhost.

Severity Level

UNKNOWN

Published Date

Aug 23, 2005

Last Modified

Apr 16, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

44.46%Probability

Root Weakness (CWE)

N/A

Affected & Patched Versions

Affected Versions

Microsoft Internet Information Server
Microsoft Internet Information Services

Patched Versions

Not provided by NVD for this CVE.

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.