{"schemaVersion":3,"id":"CVE-2007-2581","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in \"every main page,\" as demonstrated by default.aspx.","dates":{"published":"2007-05-09T21:00:00.000Z","modified":"2024-08-07T13:42:33.406Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.36226,"percentile":0.9847,"severity":"high","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.36226},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.36226,"percentile":0.9847}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.36226,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.36226,"percentile":0.9847}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"29951","name":"Microsoft SharePoint Server 3.0 - Cross-Site Scripting","source":"exploit-database","url":"https://www.exploit-db.com/exploits/29951","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/29951.txt","codes":["CVE-2007-2581"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"microsoft","product":"sharepoint_server","name":"sharepoint server","label":"sharepoint_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2007","noFixRecorded":false,"fixedIn":null}],"versionsText":"2007","eol":null,"hubHref":"/vendor/microsoft/sharepoint_server"},{"vendor":"microsoft","product":"sharepoint_services","name":"sharepoint services","label":"sharepoint_services","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.0","eol":null,"hubHref":"/vendor/microsoft/sharepoint_services"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2286","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2286","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.securityfocus.com/bid/23832","label":"www.securityfocus.com/bid/23832","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-059","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-059","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS"]},{"url":"http://securitytracker.com/id?1018789","label":"securitytracker.com/id?1018789","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2007-05/0196.html","label":"archives.neohapsis.com/archives/bugtraq/2007-05/0196.html","hostname":"archives.neohapsis.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.securityfocus.com/archive/1/482366/100/0/threaded","label":"www.securityfocus.com/archive/1/482366/100/0/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://osvdb.org/37630","label":"osvdb.org/37630","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34343","label":"exchange.xforce.ibmcloud.com/vulnerabilities/34343","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.securityfocus.com/archive/1/467738/100/0/threaded","label":"www.securityfocus.com/archive/1/467738/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://secunia.com/advisories/27148","label":"secunia.com/advisories/27148","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2007/3439","label":"www.vupen.com/english/advisories/2007/3439","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://securityreason.com/securityalert/2682","label":"securityreason.com/securityalert/2682","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://www.securityfocus.com/archive/1/467749/100/0/threaded","label":"www.securityfocus.com/archive/1/467749/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-282A.html","label":"www.us-cert.gov/cas/techalerts/TA07-282A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2007-05-09T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T13:42:33.406Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T23:43:06.992Z","stale":false,"partial":false}}