Cross‑site scripting in Microsoft SharePoint Server allows an authorized attacker to inject malicious input during web page generation, enabling page spoofing over the network. The improper neutralization of input (CWE‑79) means that crafted content can be rendered to users who navigate the affected pages, allowing an attacker to present deceptive or false information. This can undermine users’ confidence in the interface and facilitate social engineering attacks, though the description does not specify credential theft or phishing.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific version numbers are provided, so any installed instance of these products is vulnerable unless a later update addresses the flaw.

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation data. The likely attack vector is a local or network‑connected user with write or content‑injection privileges on the SharePoint web application. Because the vulnerability requires prior access to the SharePoint environment, the risk is contextual and depends on network segmentation and user role limits.