CVE-2025-42901CWE-94code-injection

CVE-2025-42901

Medium · published October 14, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability of the application.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-10-14T05:15Z
References (2)
https://me.sap.com/notes/3652788 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 14 OCT 00:17Z
    Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)
    cvelistv5