Microsoft Sharepoint Enterprise Server 2016 vulnerabilities

CVE-2020-1103 [MEDIUM] CWE-352 CVE-2020-1103: An information disclosure vulnerability exists where certain modes of the search function in Microso An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of cross-site request forgery, CSRF). When users are simultaneously logged in to Microsoft SharePoint Server and visit a malicious web page, the attacker can, through standard b

CVE-2021-31173 [MEDIUM] CWE-200 CVE-2021-31173: Microsoft SharePoint Server Information Disclosure Vulnerability Microsoft SharePoint Server Information Disclosure Vulnerability

CVE-2025-21393 [MEDIUM] CWE-79 CVE-2025-21393: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-56157 [MEDIUM] CWE-284 CVE-2026-56157: Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoo Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2021-26418 [HIGH] CWE-290 CVE-2021-26418: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2025-30378 [HIGH] CWE-502 CVE-2025-30378: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

CVE-2020-1500 [MEDIUM] CVE-2020-1500: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specia A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then per

CVE-2020-1499 [MEDIUM] CVE-2020-1499: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specia A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then per

CVE-2020-1501 [MEDIUM] CVE-2020-1501: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specia A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vulnerability could then per

CVE-2026-20958 [MEDIUM] CWE-918 CVE-2026-20958: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to d Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVE-2020-1106 [MEDIUM] CWE-79 CVE-2020-1106: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul

CVE-2020-17015 [MEDIUM] CVE-2020-17015: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2025-59235 [HIGH] CWE-125 CVE-2025-59235: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2023-33129 [MEDIUM] CWE-122 CVE-2023-33129: Microsoft SharePoint Server Denial of Service Vulnerability Microsoft SharePoint Server Denial of Service Vulnerability

CVE-2026-48560 [MEDIUM] CWE-502 CVE-2026-48560: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to pe Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-47641 [MEDIUM] CWE-20 CVE-2026-47641: Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform sp Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2025-54905 [HIGH] CWE-822 CVE-2025-54905: Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose i Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVE-2025-59232 [HIGH] CWE-125 CVE-2025-59232: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVE-2020-1345 [MEDIUM] CWE-79 CVE-2020-1345: <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not prope A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul

CVE-2020-1198 [MEDIUM] CWE-79 CVE-2020-1198: <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not prope A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited the vul