An execution flaw in Microsoft SharePoint Server allows an attacker with authorized access to insert arbitrary input into the web page generation process. The input is not properly neutralized, resulting in a classic cross‑site scripting condition that can be used to spoof the appearance or behavior of the site. The exploit can lead to users believing they are interacting with a legitimate page when, in fact, the attacker has injected deceptive content.

The vulnerability impacts Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Version information is not specified, so any release prior to the latest security update from Microsoft is potentially affected.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is unavailable, and the flaw is not listed in CISA’s KEV catalog, suggesting it is not widely exploited in the wild yet. The likely attack vector is web‑based; an attacker must have valid credentials or be able to submit content to the SharePoint instance to trigger the injection. If this condition is met, the attacker can present spoofed content to end users, undermining trust and potentially facilitating further social‑engineering or phishing attacks.