{"exploits":[{"source":"metasploit","id":"exploit/windows/http/sharepoint_toolpane_rce","title":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","type":"exploit","platform":"Windows","date":"2025-07-08","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/sharepoint_toolpane_rce"},{"source":"pocgithub","id":"Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770","title":"Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770","date":"2025-07-21","url":"https://github.com/Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770"},{"source":"pocgithub","id":"RukshanaAlikhan/CVE-2025-53770","title":"RukshanaAlikhan/CVE-2025-53770","date":"2025-07-21","url":"https://github.com/RukshanaAlikhan/CVE-2025-53770"},{"source":"pocgithub","id":"ZephrFish/CVE-2025-53770-Scanner","title":"ZephrFish/CVE-2025-53770-Scanner","date":"2025-07-21","url":"https://github.com/ZephrFish/CVE-2025-53770-Scanner"},{"source":"pocgithub","id":"gmh5225/ZeroPoint","title":"gmh5225/ZeroPoint","date":"2025-07-21","url":"https://github.com/gmh5225/ZeroPoint"},{"source":"pocgithub","id":"grupooruss/CVE-2025-53770-Checker","title":"grupooruss/CVE-2025-53770-Checker","date":"2025-07-21","url":"https://github.com/grupooruss/CVE-2025-53770-Checker"},{"source":"pocgithub","id":"hazcod/CVE-2025-53770","title":"hazcod/CVE-2025-53770","date":"2025-07-21","url":"https://github.com/hazcod/CVE-2025-53770"},{"source":"pocgithub","id":"kaizensecurity/CVE-2025-53770","title":"kaizensecurity/CVE-2025-53770","date":"2025-07-21","url":"https://github.com/kaizensecurity/CVE-2025-53770"},{"source":"pocgithub","id":"paolokappa/SharePointSecurityMonitor","title":"paolokappa/SharePointSecurityMonitor","date":"2025-07-21","url":"https://github.com/paolokappa/SharePointSecurityMonitor"},{"source":"pocgithub","id":"soltanali0/CVE-2025-53770-Exploit","title":"soltanali0/CVE-2025-53770-Exploit","date":"2025-07-21","url":"https://github.com/soltanali0/CVE-2025-53770-Exploit"},{"source":"pocgithub","id":"yosasasutsut/Blackash-CVE-2025-53770","title":"yosasasutsut/Blackash-CVE-2025-53770","date":"2025-07-21","url":"https://github.com/yosasasutsut/Blackash-CVE-2025-53770"},{"source":"pocgithub","id":"0xray5c68616e37/cve-2025-53770","title":"0xray5c68616e37/cve-2025-53770","date":"2025-07-22","url":"https://github.com/0xray5c68616e37/cve-2025-53770"},{"source":"pocgithub","id":"AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE","title":"AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE","date":"2025-07-22","url":"https://github.com/AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE"},{"source":"pocgithub","id":"GreenForceNetworks/Toolshell_CVE-2025-53770","title":"GreenForceNetworks/Toolshell_CVE-2025-53770","date":"2025-07-22","url":"https://github.com/GreenForceNetworks/Toolshell_CVE-2025-53770"},{"source":"pocgithub","id":"MuhammadWaseem29/CVE-2025-53770","title":"MuhammadWaseem29/CVE-2025-53770","date":"2025-07-22","url":"https://github.com/MuhammadWaseem29/CVE-2025-53770"},{"source":"pocgithub","id":"Sec-Dan/CVE-2025-53770-Scanner","title":"Sec-Dan/CVE-2025-53770-Scanner","date":"2025-07-22","url":"https://github.com/Sec-Dan/CVE-2025-53770-Scanner"},{"source":"pocgithub","id":"imbas007/CVE-2025-53770-Vulnerable-Scanner","title":"imbas007/CVE-2025-53770-Vulnerable-Scanner","date":"2025-07-22","url":"https://github.com/imbas007/CVE-2025-53770-Vulnerable-Scanner"},{"source":"pocgithub","id":"tripoloski1337/CVE-2025-53770-scanner","title":"tripoloski1337/CVE-2025-53770-scanner","date":"2025-07-22","url":"https://github.com/tripoloski1337/CVE-2025-53770-scanner"},{"source":"pocgithub","id":"exfil0/CVE-2025-53770","title":"exfil0/CVE-2025-53770","date":"2025-07-23","url":"https://github.com/exfil0/CVE-2025-53770"},{"source":"pocgithub","id":"zach115th/ToolShellFinder","title":"zach115th/ToolShellFinder","date":"2025-07-23","url":"https://github.com/zach115th/ToolShellFinder"},{"source":"pocgithub","id":"Rabbitbong/OurSharePoint-CVE-2025-53770","title":"Rabbitbong/OurSharePoint-CVE-2025-53770","date":"2025-07-24","url":"https://github.com/Rabbitbong/OurSharePoint-CVE-2025-53770"},{"source":"pocgithub","id":"bharath-cyber-root/sharepoint-toolshell-cve-2025-53770","title":"bharath-cyber-root/sharepoint-toolshell-cve-2025-53770","date":"2025-07-24","url":"https://github.com/bharath-cyber-root/sharepoint-toolshell-cve-2025-53770"},{"source":"pocgithub","id":"nisargsuthar/suricata-rule-CVE-2025-53770","title":"nisargsuthar/suricata-rule-CVE-2025-53770","date":"2025-07-24","url":"https://github.com/nisargsuthar/suricata-rule-CVE-2025-53770"},{"source":"pocgithub","id":"BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator","title":"BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator","date":"2025-07-25","url":"https://github.com/BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator"},{"source":"pocgithub","id":"Udyz/CVE-2025-53770-Exploit","title":"Udyz/CVE-2025-53770-Exploit","date":"2025-07-25","url":"https://github.com/Udyz/CVE-2025-53770-Exploit"},{"source":"pocgithub","id":"bitsalv/ToolShell-Honeypot","title":"bitsalv/ToolShell-Honeypot","date":"2025-07-25","url":"https://github.com/bitsalv/ToolShell-Honeypot"},{"source":"pocgithub","id":"3a7/CVE-2025-53770","title":"3a7/CVE-2025-53770","date":"2025-07-27","url":"https://github.com/3a7/CVE-2025-53770"},{"source":"pocgithub","id":"bossnick98/-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE","title":"bossnick98/-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE","date":"2025-07-27","url":"https://github.com/bossnick98/-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE"},{"source":"pocgithub","id":"0xKr1x/CVE-2025-53770-Scanner","title":"0xKr1x/CVE-2025-53770-Scanner","date":"2025-07-28","url":"https://github.com/0xKr1x/CVE-2025-53770-Scanner"},{"source":"pocgithub","id":"daryllundy/CVE-2025-53770","title":"daryllundy/CVE-2025-53770","date":"2025-07-28","url":"https://github.com/daryllundy/CVE-2025-53770"},{"source":"pocgithub","id":"r3xbugbounty/CVE-2025-53770","title":"r3xbugbounty/CVE-2025-53770","date":"2025-07-28","url":"https://github.com/r3xbugbounty/CVE-2025-53770"},{"source":"pocgithub","id":"Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC","title":"Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC","date":"2025-07-29","url":"https://github.com/Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC"},{"source":"pocgithub","id":"harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC","title":"harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC","date":"2025-08-02","url":"https://github.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC"},{"source":"pocgithub","id":"Agampreet-Singh/CVE-2025-53770","title":"Agampreet-Singh/CVE-2025-53770","date":"2025-08-07","url":"https://github.com/Agampreet-Singh/CVE-2025-53770"},{"source":"exploitdb","id":"EDB-52405","title":"Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)","type":"remote","platform":"windows","date":"2025-08-11","url":"https://www.exploit-db.com/exploits/52405"},{"source":"pocgithub","id":"CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend","title":"CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend","date":"2025-08-13","url":"https://github.com/CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend"},{"source":"pocgithub","id":"ghostn4444/CVE-2025-53770","title":"ghostn4444/CVE-2025-53770","date":"2025-08-14","url":"https://github.com/ghostn4444/CVE-2025-53770"},{"source":"pocgithub","id":"saladin0x1/CVE-2025-53770","title":"saladin0x1/CVE-2025-53770","date":"2025-09-04","url":"https://github.com/saladin0x1/CVE-2025-53770"},{"source":"pocgithub","id":"Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell","title":"Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell","date":"2025-09-23","url":"https://github.com/Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell"},{"source":"pocgithub","id":"victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320","title":"victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320","date":"2025-09-29","url":"https://github.com/victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320"},{"source":"pocgithub","id":"Cameloo1/sharepoint-toolshell-micro-postmortem","title":"Cameloo1/sharepoint-toolshell-micro-postmortem","date":"2025-11-21","url":"https://github.com/Cameloo1/sharepoint-toolshell-micro-postmortem"},{"source":"pocgithub","id":"rbctee/CVE-2025-53770","title":"rbctee/CVE-2025-53770","date":"2026-02-11","url":"https://github.com/rbctee/CVE-2025-53770"},{"source":"pocgithub","id":"J4ck3LSyN-Gen2/CVE-2025-53770","title":"J4ck3LSyN-Gen2/CVE-2025-53770","date":"2026-03-21","url":"https://github.com/J4ck3LSyN-Gen2/CVE-2025-53770"},{"source":"pocgithub","id":"Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis","title":"Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis","date":"2026-04-01","url":"https://github.com/Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis"},{"source":"pocgithub","id":"doerrdan/it-sec-toolshell","title":"doerrdan/it-sec-toolshell","date":"2026-05-28","url":"https://github.com/doerrdan/it-sec-toolshell"},{"source":"pocgithub","id":"mfarshad-abdullah-khan/cve-2025-53770-research","title":"mfarshad-abdullah-khan/cve-2025-53770-research","date":"2026-08-04","url":"https://github.com/mfarshad-abdullah-khan/cve-2025-53770-research"},{"source":"pocgithub","id":"thiconickid/sharepoint-zero-day-cs50-cybersecurity","title":"thiconickid/sharepoint-zero-day-cs50-cybersecurity","date":"2026-10-16","url":"https://github.com/thiconickid/sharepoint-zero-day-cs50-cybersecurity"},{"source":"nuclei","id":"CVE-2025-53770","title":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53770.yaml"}]}