Skip to content
CVE PROGRAM SOURCE RECORD4.7 Medium

CVE-2025-26653

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page, the injected script gets executed, potentially compromising the confidentiality and integrity within the scope of the victim�s browser. Availability is not impacted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

Default version status: unaffected

  • KRNL64NUC 7.22affected
  • 7.22EXTaffected
  • KRNL64UC 7.22affected
  • 7.53affected
  • KERNEL 7.22affected
  • 7.54affected
  • 7.77affected
  • 7.89affected
  • 7.93affected
  • 9.14affected

References