Unscored severity · published Jun 8, 2010
CVE-2010-1257
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2;…
–
CVSS
22.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
Exploitation
Is it being used?
Exploit prediction (EPSS)22.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
SharePoint · Microsoft
2007; 2007; 2007; 2007 · source: NVD
IE
Internet Explorer · Microsoft
8 · source: NVD
OI
Office Infopath · Microsoft
2003; 2007; 2007 · source: NVD
SS
Sharepoint Services · Microsoft
3.0; 3.0; 3.0; 3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1257
support.avaya.com
http://support.avaya.com/css/P8/documents/100089747
www.securityfocus.com
http://www.securityfocus.com/bid/40409
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA10-159B.html
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-035
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/58866
More from SharePoint
9.8
CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2026-50522
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2026-56164
Microsoft SharePoint Server Elevation of Privilege Vulnerability
9.8
CVE-2026-20963
Microsoft SharePoint Remote Code Execution Vulnerability
9.8
CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability