CVE-2006-1257: Microsoft Commerce Server

High severity, CVSS 7.5. EPSS: 30.3% chance of exploitation in the next 30 days.

The sample files in the authfiles directory in Microsoft Commerce Server 2002 before SP2 allow remote attackers to bypass authentication by logging in to authfiles/login.asp with a valid username and any password, then going to the main site twice.

Affected products

• Microsoft Commerce Server: version 2002 only

Published 2006-03-19. Last modified 2026-06-16.