Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2025-17498)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Microsoft SharePoint Server Remote Code Execution Vulnerability (CNVD-2025-24453)

Microsoft SharePoint Server is a groupware for Windows Server made by Microsoft that provides basic portal and corporate intranet functionality. A remote code execution vulnerability exists in Microsoft SharePoint Server due to deserialization of untrustworthy data. An attacker could exploit this...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

CVE-2025-47166

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47163

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47172

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

June Microsoft Patch Tuesday

June Microsoft Patch Tuesday. A total of 81 vulnerabilities, roughly the same as in May. Among them, 15 vulnerabilities were added between the May and June MSPT. There are 3 vulnerabilities with signs of exploitation in the wild: RCE - WEBDAV/Internet Shortcut Files CVE-2025-33053. For successful...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in Office products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary code in the victim's context, potentially gaining access to sensitive data in the victim's context. Successful exploitation...

CVE-2025-47172

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47172

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47166

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47166

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47163

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47163

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-47172 Microsoft SharePoint Server Remote Code Execution Vulnerability

...

CVE-2025-47172 Microsoft SharePoint Server Remote Code Execution Vulnerability

...

CVE-2025-47172

CVE-2025-47172 refers to a Microsoft SharePoint Server remote code execution vulnerability caused by improper neutralization of certain SQL elements in SharePoint (SQL injection). An authenticated attacker could execute code remotely over the network. Affected products include SharePoint Server o...

CVE-2025-47166 Microsoft SharePoint Server Remote Code Execution Vulnerability

...

CVE-2025-47166 Microsoft SharePoint Server Remote Code Execution Vulnerability

...

CVE-2025-47166

CVE-2025-47166 is a remote code execution vulnerability in Microsoft SharePoint Server/Office SharePoint caused by deserialization of untrusted data. An authenticated attacker could trigger code execution over the network on the affected server. The entry is tracked with a high CVSS v3.1 base sco...