← CVE Intelligence

CVE-2025-26653

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) PUBLISHED

Description (CNA)

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page, the injected script gets executed, potentially compromising the confidentiality and integrity within the scope of the victim�s browser. Availability is not impacted.

Affected (CNA)

Vendor / productVersions
SAP_SE / SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)affected KRNL64NUC 7.22; affected 7.22EXT; affected KRNL64UC 7.22; affected 7.53; affected KERNEL 7.22; affected 7.54; affected 7.77; affected 7.89; affected 7.93; affected 9.14

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.