CVE-2005-0918 json
The NPSVG3.dll ActiveX control for Adobe SVG Viewer 3.02 and earlier, when running on Internet Explorer, allows remote attackers to determi…
published 2005-05-05 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-0919
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.4%
- EPSS 2.4% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
The NPSVG3.dll ActiveX control for Adobe SVG Viewer 3.02 and earlier, when running on Internet Explorer, allows remote attackers to determine the existence of arbitrary files by setting the src property to the target filename and using Javascript to determine if the web page immediately stops loading, which indicates whether the file exists or not.
Patch / fix
Exploit prediction
2.36% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hyperdose.com http://www.hyperdose.com/advisories/H2005-07.txt referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
adobe.com
/support/techdocs/323585.html
broken-link, patch
-
hyperdose.com
/advisories/H2005-07.txt
broken-link, exploit, patch
-
secunia.com
/advisories/15255
third-party-advisory, broken-link, vendor-advisory
-
securitytracker.com
/id?1013890
vdb-entry, broken-link, third-party-advisory
Sources
- CVE List CVE-2005-0918
- NVD CVE-2005-0918
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.