CVE-2025-49704

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Jul 22, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-497057.8Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-497066.5Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.CVE-2025-497075.5Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.CVE-2025-497089.9Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.CVE-2025-497099.8Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4.CVE-2025-49718.5Broadcom Automic Automation Agent Unix versions < 24.3.0 HF4 and < 21.0.13 HF1 allow low privileged users who have execution rights on the aCVE-2025-497109.8An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4.CVE-2025-497117.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-497128.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-497138.8Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute CVE-2025-497147.8Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.CVE-2025-497157.5Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized att
CVE-2025-49704: High severity, CVSS 8.8 | Vulnix