---
id: 6157
title: "CVE-2026-45453 — Microsoft SharePoint Server Workflow Pages DocURL Parameter Reflected Cross-Site Scripting"
cve: CVE-2026-45453
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260604-cve-2026-45453-microsoft-sharepoint-server-workflow-pages-docurl-parameter-reflected-cross-site-scripting/"
published_at: "2026-06-16T00:00:00Z"
tags: ["appsec", "vulnerability-research", "xss", "sharepoint", "session-hijacking", "reflected-xss", "cve-2026-45453", "input-encoding"]
phying_url: "https://phying.com/item/6157"
lang: en
---

# CVE-2026-45453 — Microsoft SharePoint Server Workflow Pages DocURL Parameter Reflected Cross-Site Scripting

## Summary

CVE-2026-45453: reflected XSS in three SharePoint workflow pages—DocURL is written unencoded into href attributes, executing on hover and enabling session hijacking; fixed in June 2026.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-45453
- **Published:** 2026-06-16T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260604-cve-2026-45453-microsoft-sharepoint-server-workflow-pages-docurl-parameter-reflected-cross-site-scripting/
- **Phying News:** https://phying.com/item/6157