Skip to content
CVE PROGRAM SOURCE RECORD3.0 Low

CVE-2025-42990

HTML Injection in Unprotected SAPUI5 applications

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAPUI5 applications

Default version status: unaffected

  • SAP_UI 750affected
  • 754affected
  • 755affected
  • 756affected
  • 757affected
  • 758affected
  • UI_700 200affected

References