The vulnerability is an improper neutralization of input during web page generation, effectively a cross‑site scripting flaw. An attacker who already has authorized SharePoint access can insert crafted input that the server renders as part of an HTML page, allowing the attacker to display content as if it were coming from a trusted source and thus enabling spoofing over the network.

Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition are affected. No specific sub‑release information is provided, so all current releases within those products should be considered vulnerable.

The CVSS score of 4.6 indicates moderate impact. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user within the SharePoint installation who can inject malicious input. Because it requires legitimate access, the risk is most pronounced in environments with weak user privilege controls or where page generation is exposed to external users. Protecting against this flaw requires applying the vendor’s patch and ensuring proper HTML escaping of all dynamic content, in line with CWE‑20 mitigation practices.