← CVE Intelligence

CVE-2025-26659

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) PUBLISHED

Description (CNA)

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability

Affected (CNA)

Vendor / productVersions
SAP_SE / SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)affected KRNL64UC 7.53; affected KERNEL 7.53; affected KERNEL 7.54; affected KERNEL 7.77; affected KERNEL 7.89; affected KERNEL 7.93; affected KERNEL 9.14

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.