CVE-2025-26653

Description

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page, the injected script gets executed, potentially compromising the confidentiality and integrity within the scope of the victim�s browser. Availability is not impacted.

Reserved 2025-02-12 | Published 2025-04-08 | Updated 2025-04-08 | Assigner sap

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unaffected

KRNL64NUC 7.22
affected

7.22EXT
affected

KRNL64UC 7.22
affected

7.53
affected

KERNEL 7.22
affected

7.54
affected

7.77
affected

7.89
affected

7.93
affected

9.14
affected

References

me.sap.com/notes/3559307

url.sap/sapsecuritypatchday

cve.org (CVE-2025-26653)

nvd.nist.gov (CVE-2025-26653)

Download JSON