An updated description reveals that Microsoft SharePoint suffers a cross‑site scripting vulnerability caused by inadequate input neutralization during web page creation. An attacker without authorization can insert malicious scripts that cause the rendered page to behave as if it were a legitimate SharePoint interface. This spoofing can trick users into interacting with or trusting the forged page, potentially leading to credential disclosure or other social‑engineering attacks.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are impacted. The CNAs list does not identify specific sub‑versions, so any installation of these editions is potentially vulnerable.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no known exploitation has been reported. An attacker is likely to target the vulnerability remotely, and exploitation would permit spoofing of web content but not directly compromise system integrity or confidentiality.