返回 CVE 浏览器

CVE-2025-49704

🔥 Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-07-08

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Affected Platforms (CPE)

📦

Microsoft

Sharepoint Server

= 2016= 2019

References & Advisories

🔗 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704

🔗 https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

相關資安分析文章

周度网络安全新闻：2026 年 7 月 27 日

本周重大安全周报聚焦于 Check Point SmartConsole CVE-2026-16232 验证绕过之在野利用、PAN-OS GlobalProtect 漏洞与 Qilin 勒索软件侵袭、俄罗斯 LAUNDRY BEAR 对 Zimbra 进行之国家级电子邮件间谍活动，以及 Windchill 与 FakeGit 恶意 Repositories 威胁趋势。

全球网络威胁情报摘要：2026 年 7 月 23 日

本期情报重点包含 CISA 将 Langflow CVE-2026-0770 远程代码执行漏洞列入 KEV 已知利用目录、Windmill CVE-2026-29059 未经身份验证路径穿越漏洞分析，以及 SonicWall SMA1000 零日漏洞利用持续追踪与防御建议。

全球网络威胁情报摘要：2026 年 7 月 22 日

本期摘要重点分析本地部署 Microsoft SharePoint 服务器正遭主动利用之 CVE-2026-50522 漏洞、Qilin 勒索软件利用 PAN-OS CVE-2026-0257 身份验证绕过入侵企业 VPN，以及 Cisco 安全设备与关键基础设施修补处置指南。

相关漏洞威胁

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL be...

CVE-2026-174582.1

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser...

CVE-2026-174342.1

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-...

CVE-2026-174331.9

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file sr...