Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2025-26659

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

Default version status: unaffected

  • KRNL64UC 7.53affected
  • KERNEL 7.53affected
  • KERNEL 7.54affected
  • KERNEL 7.77affected
  • KERNEL 7.89affected
  • KERNEL 7.93affected
  • KERNEL 9.14affected

References