An attacker with authorized access can exploit an improper neutralization of input during web page generation in Microsoft SharePoint, enabling cross‑site scripting that allows the attacker to spoof content over the network.

Microsoft SharePoint Server Subscription Edition. No specific version information is provided, so all deployed instances are potentially affected until a security update is applied.

The CVSS score of 4.6 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attack requires authorized user privileges, suggesting that the risk primarily exists in environments where attacker access is already granted. Exploitation could lead to the display of forged content, confusing users or redirecting them to malicious sites.