CVE-2025-49704

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint (affected versions not specified)

Description Improper control of code generation, specifically code injection, allows an authorized remote attacker to execute arbitrary code over a network. This is caused by the deserialization of untrusted data via the DataSetSurrogateSelector function. An attacker can achieve remote code execution on the server by sending a specially crafted POST request containing malicious WebPart markup. Real-world exploitation of this issue has been documented.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.