{"schema":"vulnpedia.poc/1","cve":"CVE-2025-49706","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2025-07-22","ransomware":true},"epss":{"score":0.99057,"percentile":0.99931},"cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C"},"has_public_poc":true,"poc_sources":[{"kind":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb","executable":true,"sourceId":"exploit/windows/http/sharepoint_toolpane_rce","description":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","verification":"catalogued","source":"metasploit","modified":"2026-06-02 10:32:30 +0000","origins":[{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"},{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","modified":"2026-06-02 10:32:30 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"}]},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/7778878554f4","executable":false,"sourceId":"7778878554f4","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"7778878554f4","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/7778878554f4"}],"repositoryUrl":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation"}],"poc_candidates":[{"url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation","source":"poc-in-github","sourceId":"CVE-2025-49706","description":"A deep dive into CVE-2025-49706 — the SharePoint spoofing flaw now exploited in the wild for stealthy web shell deployment and privilege escalation.","modified":"2026-10-13T19:08:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-49706","url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation"},{"source":"poc-in-github","sourceId":"CVE-2025-49706","modified":"2026-10-13T19:08:18Z","url":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2025-49706 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2025-49706/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49706.yaml","template":"http/cves/2025/CVE-2025-49706.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2025-49706%22&type=repositories","executable":false}]}