CVE-2025-64672
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint arises from improper neutralization of input during web page generation. An authorized attacker can perform spoofing over a network.
Risk Assessment
An attacker with a valid account could impersonate a trusted interface or user, potentially leading to data theft or misleading employees.
Recommendation
Immediately install the latest security updates for Microsoft SharePoint and restrict user privileges to the minimum necessary.
Other vulnerabilities in Microsoft Office SharePoint
See all- CVE-2026-20951High
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- CVE-2026-20947High
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70306Critical
A cross-site scripting vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-65660HighActively exploited
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70332Critical
Improper input neutralization during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-55040CriticalActively exploited
A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.
- CVE-2026-58644CriticalActively exploited
A deserialization of untrusted data vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to execute code remotely over a network.
- CVE-2026-56164MediumActively exploited
Missing authentication for a critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-50522CriticalActively exploited
Deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An unauthenticated attacker can remotely execute code on the SharePoint server.
- CVE-2026-33112High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS