CVE-2020-1106

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1099, CVE-2020-1100, CVE-2020-1101.

• CWE-79
• CWE-79

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1106Patch, Vendor Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1106Exploit, Third Party Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1106Patch, Vendor Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1106Exploit, Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1106Exploit, Third Party Advisory

Published

May 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11054In qutebrowser versions less than 1.11.1, reloading a page w…3.5
• CVE-2020-11055In BookStack greater than or equal to 0.18.0 and less than 0…5.4
• CVE-2020-11056In Sprout Forms before 3.9.0, there is a potential Server-Si…6.3
• CVE-2020-11057In XWiki Platform 7.2 through 11.10.2, registered users with…8.8
• CVE-2020-11058In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bound…2.2
• CVE-2020-11059In AEgir greater than or equal to 21.7.0 and less than 21.10…7.5
• CVE-2020-11060In GLPI before 9.4.6, an attacker can execute system command…8.8
• CVE-2020-11061In Bareos Director less than or equal to 16.2.10, 17.2.9, 18…7.4
• CVE-2020-11062In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XS…5.4
• CVE-2020-11063In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discove…3.7
• CVE-2020-11064In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.…5.4
• CVE-2020-11065In TYPO3 CMS greater than or equal to 9.5.12 and less than 9…5.4