CVE-2009-1535

The record

The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.

Affected packages

Related vulnerabilities

• CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
• CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
• CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287
• CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-287
• CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40… CWE-287
• CVE-2026-14563 The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the… CWE-287
• CVE-2026-14559 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's… CWE-287
• CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints… CWE-287