CVE-2007-2581 EXPLOIT
4.3
MEDIUM · CVSS 2.0 · EPSS 36.2% (pctl 98)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 36.23% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-05-09 |
| Last modified | 2026-06-16 |
Affected (3)
| Vendor | Product |
|---|---|
| microsoft | sharepoint server |
| microsoft | sharepoint services |
| microsoft | windows 2003 |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft SharePoint Server 3.0 - Cross-Site Scripting | 2007-05-04 |
References
- http://archives.neohapsis.com/archives/bugtraq/2007-05/0196.html
- http://osvdb.org/37630
- http://secunia.com/advisories/27148
- http://securityreason.com/securityalert/2682
- http://securitytracker.com/id?1018789
- http://www.securityfocus.com/archive/1/467738/100/0/threaded
- http://www.securityfocus.com/archive/1/467749/100/0/threaded
- http://www.securityfocus.com/archive/1/482366/100/0/threaded
- http://www.securityfocus.com/bid/23832
- http://www.us-cert.gov/cas/techalerts/TA07-282A.html
- http://www.vupen.com/english/advisories/2007/3439
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-059
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34343
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2286
- http://archives.neohapsis.com/archives/bugtraq/2007-05/0196.html
- http://osvdb.org/37630
- http://secunia.com/advisories/27148
- http://securityreason.com/securityalert/2682
- http://securitytracker.com/id?1018789
- http://www.securityfocus.com/archive/1/467738/100/0/threaded
→ the Explorer · watch your stack · NVD