CVE-2010-1257
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office...
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
- Record
CVE-2010-1257- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
- Record
CVE-2010-1257- Updated
- 2026-11-02
EUVDEUVD-2010-1286 No score
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
- Record
EUVD-2010-1286- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f2pm-wfcp-596f No score
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office...
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
- Record
GHSA-f2pm-wfcp-596f- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-1257 is a medium vulnerability (CVSS 4.3) in Microsoft Internet Explorer, published June 8, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.2%, the 97th percentile. No source names a fixed version.
References
support.avaya.com/css/P8/documents/100089747
exchange.xforce.ibmcloud.com/vulnerabilities/58866
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039
securityfocus.com/bid/40409
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6677
us-cert.gov/cas/techalerts/TA10-159B.html
nvd.nist.gov/vuln/detail/CVE-2010-1257
github.com/advisories/GHSA-f2pm-wfcp-596f