CVE-2026-70306
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
- EPSS probability
- 0.75%
- CWE
- CWE-79
- Published
- 2026-08-11
- Last modified
- 2026-09-09
Affected products
- Microsoft Microsoft SharePoint Enterprise Server 2016
- Microsoft Microsoft SharePoint Server 2019
- Microsoft Microsoft SharePoint Server Subscription Edition
Weakness type
Related vulnerabilities
- CVE-2026-87814 — SiYuan before v3.8.2 Stored XSS via Asset Preview
- CVE-2026-87813 — SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
- CVE-2026-87812 — SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
- CVE-2026-87811 — SiYuan before v3.8.2 Stored XSS via notebook template paths
- CVE-2025-3271 — DOM-based XSS vulnerability in OpenText™ Documentum Webtop
- CVE-2026-14989 — Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
- CVE-2026-17149 — myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
- CVE-2025-7062 — Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education