CVE-2010-0716: _layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same ho...

Security readout for executives and security teams

This CVE describes a cross-site scripting risk in legacy Microsoft SharePoint before 2010. An authenticated user could upload a text file in a way that may run script in the site’s trusted origin. The record has no CVSS score, no KEV listing, and notes Microsoft disputed the significance because cross-domain isolation can be used. Likely exposure is limited to organizations still running Microsoft SharePoint versions before 2010 with authenticated document upload enabled and without cross-domain isolation. The source bundle does not identify exact affected builds, supported products, or internet exposure patterns. Prioritize this if legacy SharePoint remains in production or exposed to broad user populations. It is not supported as an active exploitation emergency by the provided sources, but it is a governance issue for unsupported collaboration platforms. Mitigation focus: Identify any Microsoft SharePoint deployments older than 2010.; Check vendor or Microsoft guidance for applicable updates or configuration advice.; Implement cross-domain isolation for user-uploaded content where needed..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.