CVE-2005-3312 json
The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML…
published 2005-10-26 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-3311
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 11.9%
- EPSS 11.9% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the web server response and file extension indicate that it should be treated as a different file type.
Exploit prediction
11.89% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- scip.ch http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1746 referenced PoC, tagged "exploit" by a source, unverified
- computec.ch http://www.computec.ch/download.php?view.683 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
References
-
scip.ch
/cgi-bin/smss/showadvf.pl?id=1746
exploit, vendor-advisory
-
computec.ch
/download.php?view.683
exploit
-
securiteam.com
/windowsntfocus/6F00B00EBY.html
vendor-advisory
-
securityreason.com
/securityalert/18
third-party-advisory
-
marc.info
/?l=bugtraq&m=113017003617987&w=2
mailing-list
Sources
- CVE List CVE-2005-3312
- NVD CVE-2005-3312
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.