Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) (SAP_SE SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML))

CVE-2025-26653
MEDIUM 4.7

At a glance

Source
NVD
EPSS
EPSS 0.24 % · percentile 15 ()
State
PUBLISHED
Published
Updated
Assigner
sap
NVD status
Deferred

Search on…

Description

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page, the injected script gets executed, potentially compromising the confidentiality and integrity within the scope of the victim�s browser. Availability is not impacted.

Weaknesses (CWE)

  • CWE-79 — Improper Neutralization of Input During Web Page Generation

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:Nsap
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · cna@sap.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
SAP_SE · SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)affected KRNL64NUC 7.22 ; affected 7.22EXT ; affected KRNL64UC 7.22 ; affected 7.53 ; affected KERNEL 7.22 ; affected 7.54

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD