CVE-2010-1257

Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

Published: 2010-06-08 Last update: 2026-04-29 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2010-1257 is rated Moderate Risk (46.1/100): CVSS Medium severity, with high exploitation likelihood (EPSS 36.86%, 97th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2010-1257

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-28 44.93% 36.86% -8.07%
2 2025-12-27 36.86% 44.93% +8.07%
3 2025-10-28 — 36.86% —

Full EPSS history (27 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2010-1257

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
 8.6 2.9 [email protected]

Weakness enumeration for CVE-2010-1257

Affected software / configurations for CVE-2010-1257

Vendor Product Version Raw CPE
microsoft office_infopath 2003 cpe:2.3:a:microsoft:office_infopath:2003:sp3:*:*:*:*:*:*
microsoft office_infopath 2007 cpe:2.3:a:microsoft:office_infopath:2007:sp1:*:*:*:*:*:*
microsoft office_infopath 2007 cpe:2.3:a:microsoft:office_infopath:2007:sp2:*:*:*:*:*:*
microsoft sharepoint_server 2007 cpe:2.3:a:microsoft:sharepoint_server:2007:sp1:x32:*:*:*:*:*
microsoft sharepoint_server 2007 cpe:2.3:a:microsoft:sharepoint_server:2007:sp1:x64:*:*:*:*:*
microsoft sharepoint_server 2007 cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:x32:*:*:*:*:*
microsoft sharepoint_server 2007 cpe:2.3:a:microsoft:sharepoint_server:2007:sp2:x64:*:*:*:*:*
microsoft sharepoint_services 3.0 cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x32:*:*:*:*:*
microsoft sharepoint_services 3.0 cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x64:*:*:*:*:*
microsoft sharepoint_services 3.0 cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32:*:*:*:*:*
microsoft sharepoint_services 3.0 cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x64:*:*:*:*:*
microsoft internet_explorer 8 cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*

References for CVE-2010-1257

cvelogic Threat Intelligence