EUVD Vulnerability Catalog

EUVD-2026-114059

Severity: HIGH Base Score: 8.5 CVSS Version: 4.0

Vulnerability Description

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): Low

▪ User Interaction (UI): Passive

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): Low

▪ Vulnerability Availability Impact (VA): None

▪ Subsequent Confidentiality Impact (SC): High

▪ Subsequent Integrity Impact (SI): High

▪ Subsequent Availability Impact (SA): High

References & Advisory Links

https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4508-is-here

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

CIRCL

EPSS Probability

0.24

Known Aliases

CVE-2026-119680 GHSA-4rm7-wmp2-9p6w

Published On

2026-10-30

Last Updated

2026-11-06