CVE-2025-64672

published 2025-12-09

CVE-2025-64672: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…

critical 9 CVSS 3.1

AV N AC L PR L UI R S C C H I H A H

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	microsoft_sharepoint_server_subscription_edition	>= 16.0.0 < 16.0.19127.20378	16.0.19127.20378
microsoft	sharepoint_server	< 16.0.19127.20378	16.0.19127.20378
msrc	microsoft_sharepoint_server_subscription_edition	—	—

CWE-79