CVE-2007-2581

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0...

4.3 MediumPublic exploit

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.

Exploit likelihood

36.2%Down 18.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2007-2581
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2007-2581
Updated: 2026-11-02

EUVDEUVD-2007-2574 No score

Record: EUVD-2007-2574
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9cxq-qfj2-hvjw No score

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0...

Record: GHSA-9cxq-qfj2-hvjw
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft SharePoint Server 3.0 - Cross-Site Scripting	2007-05-04

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	aliases, exploits, facts, references, title	Exploit-DB, GitHub Advisories
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-2581 is a medium vulnerability (CVSS 4.3) in Microsoft Sharepoint Server, published May 9, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 36.2%, the 98th percentile. No source names a fixed version.

References

Show 10 moreShow less