{"schema":"vulnpedia.poc/1","cve":"CVE-2025-53770","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2025-07-20","ransomware":true},"epss":{"score":0.99999,"percentile":0.99991},"cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:W/RC:C"},"has_public_poc":true,"poc_sources":[{"kind":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb","executable":true,"sourceId":"exploit/windows/http/sharepoint_toolpane_rce","description":"Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)","verification":"catalogued","source":"metasploit","modified":"2026-06-02 10:32:30 +0000","origins":[{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"},{"source":"metasploit","sourceId":"exploit/windows/http/sharepoint_toolpane_rce","modified":"2026-06-02 10:32:30 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sharepoint_toolpane_rce.rb"}]},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/4aa1e489b5bd","executable":false,"sourceId":"4aa1e489b5bd","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"4aa1e489b5bd","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/4aa1e489b5bd"}],"repositoryUrl":"https://github.com/kaizensecurity/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/bcccd72ac61b","executable":false,"sourceId":"bcccd72ac61b","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"bcccd72ac61b","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/bcccd72ac61b"}],"repositoryUrl":"https://github.com/soltanali0/CVE-2025-53770-Exploit"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/28f126b21908","executable":false,"sourceId":"28f126b21908","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"28f126b21908","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/28f126b21908"}],"repositoryUrl":"https://github.com/hazcod/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b07b4056ae83","executable":false,"sourceId":"b07b4056ae83","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b07b4056ae83","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/b07b4056ae83"}],"repositoryUrl":"https://github.com/GreenForceNetwork/Toolshell_CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/61f35dc317ee","executable":false,"sourceId":"61f35dc317ee","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"61f35dc317ee","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/61f35dc317ee"}],"repositoryUrl":"https://github.com/MuhammadWaseem29/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/040342045c8a","executable":false,"sourceId":"040342045c8a","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"040342045c8a","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/040342045c8a"}],"repositoryUrl":"https://github.com/bijikutu/CVE-2025-53770-Exploit"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/44954e7e670d","executable":false,"sourceId":"44954e7e670d","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"44954e7e670d","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/44954e7e670d"}],"repositoryUrl":"https://github.com/b33b0y/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/436b5b65d72a","executable":false,"sourceId":"436b5b65d72a","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"436b5b65d72a","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/436b5b65d72a"}],"repositoryUrl":"https://github.com/Kamal-Hegazi/CVE-2025-53770-SharePoint-RCE"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/de880bd2afb1","executable":false,"sourceId":"de880bd2afb1","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"de880bd2afb1","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/de880bd2afb1"}],"repositoryUrl":"https://github.com/exfil0/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/a45944bad382","executable":false,"sourceId":"a45944bad382","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a45944bad382","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/a45944bad382"}],"repositoryUrl":"https://github.com/Rabbitbong/OurSharePoint-CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/f68dbdcf33e0","executable":false,"sourceId":"f68dbdcf33e0","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"f68dbdcf33e0","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/f68dbdcf33e0"}],"repositoryUrl":"https://github.com/Udyz/CVE-2025-53770-Exploit"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/eb64e3ff9e58","executable":false,"sourceId":"eb64e3ff9e58","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"eb64e3ff9e58","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/eb64e3ff9e58"}],"repositoryUrl":"https://github.com/r3xbugbounty/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/8f2279dbd625","executable":false,"sourceId":"8f2279dbd625","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"8f2279dbd625","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/8f2279dbd625"}],"repositoryUrl":"https://github.com/3a7/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/8f8c644e7a29","executable":false,"sourceId":"8f8c644e7a29","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"8f8c644e7a29","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/8f8c644e7a29"}],"repositoryUrl":"https://github.com/0xray5c68616e37/cve-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/cdfb6637e182","executable":false,"sourceId":"cdfb6637e182","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"cdfb6637e182","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/cdfb6637e182"}],"repositoryUrl":"https://github.com/BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/6144126cb2b0","executable":false,"sourceId":"6144126cb2b0","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"6144126cb2b0","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/6144126cb2b0"}],"repositoryUrl":"https://github.com/0x-crypt/CVE-2025-53770-Scanner"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/fd86e5458039","executable":false,"sourceId":"fd86e5458039","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"fd86e5458039","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/fd86e5458039"}],"repositoryUrl":"https://github.com/Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/3370992d69e8","executable":false,"sourceId":"3370992d69e8","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"3370992d69e8","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/3370992d69e8"}],"repositoryUrl":"https://github.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/56876df800ca","executable":false,"sourceId":"56876df800ca","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"56876df800ca","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/56876df800ca"}],"repositoryUrl":"https://github.com/Agampreet-Singh/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/6e8561b6f99c","executable":false,"sourceId":"6e8561b6f99c","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"6e8561b6f99c","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/6e8561b6f99c"}],"repositoryUrl":"https://github.com/behnamvanda/CVE-2025-53770-Checker"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/c643a8c3969c","executable":false,"sourceId":"c643a8c3969c","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"c643a8c3969c","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/c643a8c3969c"}],"repositoryUrl":"https://github.com/ghostn4444/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/9144508904c1","executable":false,"sourceId":"9144508904c1","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9144508904c1","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/9144508904c1"}],"repositoryUrl":"https://github.com/saladin0x1/CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5bcc8e582461","executable":false,"sourceId":"5bcc8e582461","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5bcc8e582461","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/5bcc8e582461"}],"repositoryUrl":"https://github.com/go-bi/sharepoint-CVE-2025-53770"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/51df78344fd2","executable":false,"sourceId":"51df78344fd2","verification":"catalogued","source":"vulncheck-kev","modified":"2025-07-18T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"51df78344fd2","modified":"2025-07-18T00:00:00Z","url":"https://vulncheck.com/xdb/51df78344fd2"}],"repositoryUrl":"https://github.com/rbctee/CVE-2025-53770"},{"kind":"exploitdb","id":"52405","url":"https://www.exploit-db.com/exploits/52405","code":"https://www.exploit-db.com/download/52405","executable":true}],"poc_candidates":[{"url":"https://github.com/RukshanaAlikhan/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"A critical zero-day vulnerability CVE‑2025‑53770 has been actively exploited in the wild against on-premises  Microsoft SharePoint Server. Dubbed \"ToolShell,\" this exploit leverages a deserialization flaw (variant of  CVE‑2025‑49706, CVSS: 6.3).","modified":"2025-07-21T04:43:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/RukshanaAlikhan/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-21T04:43:31Z","url":"https://github.com/RukshanaAlikhan/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-22T13:18:53Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-22T13:18:53Z","url":"https://github.com/Bluefire-Redteam-Cybersecurity/bluefire-sharepoint-cve-2025-53770"}],"tags":[]},{"url":"https://github.com/kaizensecurity/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"POC","modified":"2026-10-23T19:03:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/kaizensecurity/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-23T19:03:47Z","url":"https://github.com/kaizensecurity/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/yosasasutsut/Blackash-CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"CVE-2025-53770","modified":"2025-07-21T09:00:03Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/yosasasutsut/Blackash-CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-21T09:00:03Z","url":"https://github.com/yosasasutsut/Blackash-CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/paolokappa/SharePointSecurityMonitor","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2025-53770 protection, advanced DLL analysis, threat detection, and automated alerting capabilities.","modified":"2025-08-01T18:05:24Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/paolokappa/SharePointSecurityMonitor"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-08-01T18:05:24Z","url":"https://github.com/paolokappa/SharePointSecurityMonitor"}],"tags":[]},{"url":"https://github.com/gmh5225/ZeroPoint","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"This PowerShell script detects indicators of compromise for CVE-2025-53770 — a critical RCE vulnerability in Microsoft SharePoint.  Created by @n1chr0x and @BlackRazer67","modified":"2025-07-21T13:18:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/gmh5225/ZeroPoint"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-21T13:18:44Z","url":"https://github.com/gmh5225/ZeroPoint"}],"tags":[]},{"url":"https://github.com/soltanali0/CVE-2025-53770-Exploit","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"SharePoint WebPart Injection Exploit Tool","modified":"2026-10-14T12:38:13Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/soltanali0/CVE-2025-53770-Exploit"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-14T12:38:13Z","url":"https://github.com/soltanali0/CVE-2025-53770-Exploit"}],"tags":[]},{"url":"https://github.com/hazcod/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Scanner for the SharePoint CVE-2025-53770 RCE zero day vulnerability.","modified":"2026-10-02T19:57:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/hazcod/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-02T19:57:29Z","url":"https://github.com/hazcod/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/ZephrFish/CVE-2025-53770-Scanner","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"ToolShell scanner - CVE-2025-53770 and detection information","modified":"2026-07-30T13:45:09Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/ZephrFish/CVE-2025-53770-Scanner"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-07-30T13:45:09Z","url":"https://github.com/ZephrFish/CVE-2025-53770-Scanner"}],"tags":[]},{"url":"https://github.com/grupooruss/CVE-2025-53770-Checker","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Comprueba si un servidor SharePoint on-premises es vulnerable a CVE-2025-53770","modified":"2026-06-22T14:30:51Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/grupooruss/CVE-2025-53770-Checker"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-06-22T14:30:51Z","url":"https://github.com/grupooruss/CVE-2025-53770-Checker"}],"tags":[]},{"url":"https://github.com/tripoloski1337/CVE-2025-53770-scanner","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-22T13:05:04Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/tripoloski1337/CVE-2025-53770-scanner"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-22T13:05:04Z","url":"https://github.com/tripoloski1337/CVE-2025-53770-scanner"}],"tags":[]},{"url":"https://github.com/AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"A critical zero-auth RCE vulnerability in SharePoint (CVE-2025-53770), now exploited in the wild, building directly on the spoofing flaw CVE-2025-49706.","modified":"2026-02-28T08:03:27Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-02-28T08:03:27Z","url":"https://github.com/AdityaBhatt3010/CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE"}],"tags":[]},{"url":"https://github.com/GreenForceNetworks/Toolshell_CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-22T11:37:02Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/GreenForceNetworks/Toolshell_CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-22T11:37:02Z","url":"https://github.com/GreenForceNetworks/Toolshell_CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/imbas007/CVE-2025-53770-Vulnerable-Scanner","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-28T06:47:28Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/imbas007/CVE-2025-53770-Vulnerable-Scanner"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-28T06:47:28Z","url":"https://github.com/imbas007/CVE-2025-53770-Vulnerable-Scanner"}],"tags":[]},{"url":"https://github.com/Sec-Dan/CVE-2025-53770-Scanner","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"A Python-based reconnaissance scanner for safely identifying potential exposure to SharePoint vulnerability CVE-2025-53770.","modified":"2026-07-05T11:43:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Sec-Dan/CVE-2025-53770-Scanner"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-07-05T11:43:26Z","url":"https://github.com/Sec-Dan/CVE-2025-53770-Scanner"}],"tags":[]},{"url":"https://github.com/MuhammadWaseem29/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Unauthenticated Remote Code Execution via unsafe deserialization in Microsoft SharePoint Server (CVE-2025-53770)","modified":"2026-10-03T01:46:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/MuhammadWaseem29/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-03T01:46:14Z","url":"https://github.com/MuhammadWaseem29/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/0xray5c68616e37/cve-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Unauthenticated Remote Code Execution via unsafe deserialization in Microsoft SharePoint Server (CVE-2025-53770)","modified":"2025-07-22T22:33:13Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/0xray5c68616e37/cve-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-22T22:33:13Z","url":"https://github.com/0xray5c68616e37/cve-2025-53770"}],"tags":[]},{"url":"https://github.com/exfil0/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"A sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770, a critical (CVSS 9.8) unauthenticated remote code execution (RCE) vulnerability in on-premises Microsoft SharePoint Server (2016, 2019, Subscription Edition)","modified":"2026-05-13T16:26:24Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/exfil0/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-05-13T16:26:24Z","url":"https://github.com/exfil0/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/zach115th/ToolShellFinder","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Scans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771","modified":"2026-10-24T22:13:11Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/zach115th/ToolShellFinder"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-24T22:13:11Z","url":"https://github.com/zach115th/ToolShellFinder"}],"tags":[]},{"url":"https://github.com/nisargsuthar/suricata-rule-CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Detection rules for CVE-2025-53770","modified":"2025-07-24T23:33:35Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/nisargsuthar/suricata-rule-CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-24T23:33:35Z","url":"https://github.com/nisargsuthar/suricata-rule-CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/bharath-cyber-root/sharepoint-toolshell-cve-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-24T16:21:34Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/bharath-cyber-root/sharepoint-toolshell-cve-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-24T16:21:34Z","url":"https://github.com/bharath-cyber-root/sharepoint-toolshell-cve-2025-53770"}],"tags":[]},{"url":"https://github.com/Rabbitbong/OurSharePoint-CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Do you really think SharePoint is safe? ","modified":"2026-10-24T21:24:00Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Rabbitbong/OurSharePoint-CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-24T21:24:00Z","url":"https://github.com/Rabbitbong/OurSharePoint-CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/Udyz/CVE-2025-53770-Exploit","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-03-11T18:27:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Udyz/CVE-2025-53770-Exploit"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-03-11T18:27:47Z","url":"https://github.com/Udyz/CVE-2025-53770-Exploit"}],"tags":[]},{"url":"https://github.com/bitsalv/ToolShell-Honeypot","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Honeypot for CVE-2025-53770 aka ToolShell","modified":"2025-07-29T08:48:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/bitsalv/ToolShell-Honeypot"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-29T08:48:26Z","url":"https://github.com/bitsalv/ToolShell-Honeypot"}],"tags":[]},{"url":"https://github.com/BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Just a quick script I cooked up to exploit CVE-2025-53770","modified":"2025-08-07T08:15:59Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-08-07T08:15:59Z","url":"https://github.com/BirdsAreFlyingCameras/CVE-2025-53770_Raw-HTTP-Request-Generator"}],"tags":[]},{"url":"https://github.com/bossnick98/-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"An activity  to train analysis skills and reporting","modified":"2025-07-27T15:23:49Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/bossnick98/-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-27T15:23:49Z","url":"https://github.com/bossnick98/-SOC342---CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-and-RCE"}],"tags":[]},{"url":"https://github.com/3a7/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"CVE-2025-53770 Mass Scanner","modified":"2026-10-02T19:57:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/3a7/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-02T19:57:29Z","url":"https://github.com/3a7/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/r3xbugbounty/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-28T03:40:28Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/r3xbugbounty/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-07-28T03:40:28Z","url":"https://github.com/r3xbugbounty/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/daryllundy/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Tools for detecting and assessing systems vulnerable to CVE-2025-53770 (CWE-502: Deserialization of Untrusted Data).","modified":"2026-04-03T19:31:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/daryllundy/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-04-03T19:31:29Z","url":"https://github.com/daryllundy/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/0xKr1x/CVE-2025-53770-Scanner","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"🎯 Vulnerability scanner for SharePoint servers affected by CVE-2025-53770. Detects unsafe deserialization using ToolPane.aspx with a crafted base64+gzip payload. 🛡️ Developed by Ahmed Tamer.","modified":"2026-09-25T12:05:23Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/0xKr1x/CVE-2025-53770-Scanner"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-09-25T12:05:23Z","url":"https://github.com/0xKr1x/CVE-2025-53770-Scanner"}],"tags":[]},{"url":"https://github.com/Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-12-29T09:11:19Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-12-29T09:11:19Z","url":"https://github.com/Immersive-Labs-Sec/SharePoint-CVE-2025-53770-POC"}],"tags":[]},{"url":"https://github.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"A critical vulnerability in Microsoft SharePoint Server allows unauthenticated remote code execution via deserialization of untrusted data. Microsoft is aware of active exploitation; apply CVE mitigations immediately. Severity: Critical.","modified":"2026-03-15T08:44:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-03-15T08:44:42Z","url":"https://github.com/harryhaxor/CVE-2025-53770-SharePoint-Deserialization-RCE-PoC"}],"tags":[]},{"url":"https://github.com/Agampreet-Singh/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-08-07T15:17:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Agampreet-Singh/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-08-07T15:17:47Z","url":"https://github.com/Agampreet-Singh/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-08-13T14:43:01Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-08-13T14:43:01Z","url":"https://github.com/CyprianAtsyor/ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend"}],"tags":[]},{"url":"https://github.com/ghostn4444/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"CVE-2025-53770 - SharePoint","modified":"2025-08-14T09:11:53Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/ghostn4444/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-08-14T09:11:53Z","url":"https://github.com/ghostn4444/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/saladin0x1/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-26T00:12:36Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/saladin0x1/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-26T00:12:36Z","url":"https://github.com/saladin0x1/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-09-24T16:42:25Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-09-24T16:42:25Z","url":"https://github.com/Michaael01/LetsDefend--SOC-342-CVE-2025-53770-SharePoint-Exploit-ToolShell"}],"tags":[]},{"url":"https://github.com/victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320","source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-10-05T14:49:40Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-10-05T14:49:40Z","url":"https://github.com/victormbogu1/LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320"}],"tags":[]},{"url":"https://github.com/Cameloo1/sharepoint-toolshell-micro-postmortem","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Reproducible incident micro-postmortem for on-prem Microsoft SharePoint “ToolShell” (CVE-2025-53770): ATT&CK snapshot, “logs that matter” table, three hunts (KQL/SPL/Sigma), first-4-hours comms, sample data, and figures. Built for fast triage; no org data; SharePoint Online out of scope.","modified":"2025-12-19T18:07:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Cameloo1/sharepoint-toolshell-micro-postmortem"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2025-12-19T18:07:44Z","url":"https://github.com/Cameloo1/sharepoint-toolshell-micro-postmortem"}],"tags":[]},{"url":"https://github.com/rbctee/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Scanner for the SharePoint CVE-2025-53770 RCE zero day vulnerability (fork from hazcod/CVE-2025-53770)","modified":"2026-07-24T01:37:55Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/rbctee/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-07-24T01:37:55Z","url":"https://github.com/rbctee/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/J4ck3LSyN-Gen2/CVE-2025-53770","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Lab & PoC","modified":"2026-10-22T10:44:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/J4ck3LSyN-Gen2/CVE-2025-53770"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-22T10:44:31Z","url":"https://github.com/J4ck3LSyN-Gen2/CVE-2025-53770"}],"tags":[]},{"url":"https://github.com/Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"Technical analysis of a SharePoint ToolShell (CVE-2025-53770) exploitation attempt involving RCE, webshell deployment, and MachineKey extraction.","modified":"2026-04-18T06:55:51Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-04-18T06:55:51Z","url":"https://github.com/Zedocun/SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis"}],"tags":[]},{"url":"https://github.com/doerrdan/it-sec-toolshell","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"A Marp slide deck about CVE-2025-53770","modified":"2026-06-01T08:16:35Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/doerrdan/it-sec-toolshell"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-06-01T08:16:35Z","url":"https://github.com/doerrdan/it-sec-toolshell"}],"tags":[]},{"url":"https://github.com/mfarshad-abdullah-khan/cve-2025-53770-research","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"🚨 Threat intel & incident response research on SharePoint \"ToolShell\" RCE zero-day (CVE-2025-53770). 🕵️‍♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️","modified":"2026-08-04T12:27:15Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/mfarshad-abdullah-khan/cve-2025-53770-research"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-08-04T12:27:15Z","url":"https://github.com/mfarshad-abdullah-khan/cve-2025-53770-research"}],"tags":[]},{"url":"https://github.com/thiconickid/sharepoint-zero-day-cs50-cybersecurity","source":"poc-in-github","sourceId":"CVE-2025-53770","description":"CS50 Cybersecurity Final Project - Analysis of CVE-2025-53770 SharePoint Zero-Day Attacks","modified":"2026-10-16T19:24:38Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2025-53770","url":"https://github.com/thiconickid/sharepoint-zero-day-cs50-cybersecurity"},{"source":"poc-in-github","sourceId":"CVE-2025-53770","modified":"2026-10-16T19:24:38Z","url":"https://github.com/thiconickid/sharepoint-zero-day-cs50-cybersecurity"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2025-53770 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"searchsploit","cmd":"searchsploit --cve CVE-2025-53770 && searchsploit -m 52405","note":"Fetch the ExploitDB PoC locally; review the code before running it."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2025-53770/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53770.yaml","template":"http/cves/2025/CVE-2025-53770.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2025-53770%22&type=repositories","executable":false}]}