SharePoint

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

About

SharePoint is Microsoft's platform for intranet sites and shared documents. On premises, SharePoint Server runs on Windows Server under IIS and the .NET framework, and keeps its content in SQL Server. SharePoint Online is the version Microsoft runs for you in Microsoft 365, so you manage only the content and permissions.

How to Spot It

These are signs that a system runs SharePoint, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Path

/_layouts/15/

Response header

MicrosoftSharePointTeamServices: 16.0.0.10399

Response header

X-SharePointHealthScore: 0

If It Has a Flaw

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where SharePoint sits.

• CVE-2025-53770 (opens in a new tab)2025

  ToolShell

  An unauthenticated attacker could run code on an on-premises SharePoint server.

  Reach It gave full access to SharePoint's content, files and settings, and exposed its machine keys.

Stacks and Code

SharePoint is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.

In Common Stacks

SharePoint, On PremisesSharePoint Online

Its Code Comes From

Vendor Updates

Sources

• Microsoft Learn: SharePoint Server (opens in a new tab)