Improper web page generation, a cross‑site scripting flaw, allows an authorized attacker to create spoofed pages within Microsoft SharePoint. The attacker can modify page content that is rendered in users, misleading visitors into thinking they are on a legitimate page while the attacker controls the displayed information. This type of spoofing can compromise confidentiality or trust, but there is no evidence of direct code execution or system compromise.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific version qualifiers are listed; any deployments using these product lines are potentially vulnerable.

The CVSS score of 4.6 indicates a low severity risk, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further indicating limited current exploitation. Because the flaw requires an attacker to possess authorized access to edit or create pages, the attack vector is likely insider or compromised credentials rather than a fully remote attacker. With proper access control and input sanitisation in place, the risk can be substantially mitigated, but the possibility of spoofing remains if privileges are mis‑managed.