Improper neutralization of input during web page generation in Microsoft SharePoint enables cross‑site scripting that can cause a malicious site to appear authentic to users. The vulnerability allows an authorized attacker to inject content that is rendered as part of the SharePoint interface, enabling spoofing across the network. This can lead to users believing that an attacker’s content is coming from the legitimate SharePoint system, potentially enabling further deception or phishing attacks. The weakness is a classic cross‑site scripting flaw classified as CWE‑79.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific version details are listed beyond the product names, indicating that multiple releases within these product lines may be vulnerable.

The CVSS score of 4.6 classifies the severity as moderate, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to already possess authorized access to the SharePoint environment; there is no indication that a publicly exposed exploitation pathway exists. Therefore, insiders or compromised accounts are the primary threat vector, and the risk is amplified where privileged users can manipulate web content.