CVE-2016-0011

Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.

CVSS 3.0

5.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

5.3% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2016-01-13

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• microsoft:sharepoint_foundation
• microsoft:sharepoint_server

References

• http://www.securitytracker.com/id/1034653
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004
• http://www.securitytracker.com/id/1034653
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-004

Check your stackJSON