CVE-2026-69615: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69804: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check time-of-use toctou race condition in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

PT-2026-87437

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

PT-2026-87321

Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

PT-2026-87778

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

PT-2026-87634

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

PT-2026-87730

Time-of-check time-of-use toctou race condition in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-69402: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-15933

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

CVE-2026-15933 Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

The vulnerability of the Business Connectivity Services (BCS) framework in Microsoft SharePoint Server and SharePoint Enterprise Server allows a perpetrator to execute arbitrary code.

The vulnerability of the Business Connectivity Services BCS framework in Microsoft SharePoint Server and SharePoint Enterprise Server stems from the insecure creation of .NET types through insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary...

Microsoft SharePoint Server - Remote Code Execution (ToolShell)

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 authentication bypass, enables unauthenticated remote code...

vulnerabilities present in Microsoft Office

Microsoft has identified vulnerabilities in various Office products. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage as described in the following table. For successful exploitation, the malicious individual must deceive the victim into opening ...

Exploit for CVE-2026-55040

JWT Token Bypass Exploit for Microsoft SharePoint CVE-2026-5504...

Exploit for Improper Input Validation in Microsoft

CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 cha...

VulnCheck KEV: CVE-2026-63520

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

...

CVE-2025-53770-Scanner

🛡️ Scanner de Vulnerabilidade CVE-2025-53770 no SharePoint Uma ferramenta baseada em Python para detectar instâncias vulneráveis do Microsoft SharePoint afetadas por CVE-2025-53770 , uma vulnerabilidade de desserialização insegura acionada através do endpoint ToolPane.aspx. O scanner envia um...

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, stating they are being exploited in the wild. The shortcomings added to the KEV catalog are listed below - CVE-2026-65400 CVSS score: 9...

The vulnerabilities of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server allow attackers to perform spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow attackers to perform spear-phishing...