CVE-2025-42920CWE-79

Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management

Medium · published September 9, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
18.6
In the wild
Unconfirmed
What it is

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is processed during the page generation, resulting in the execution of malicious content. This execution allows the attacker to access and modify information within the victim's browser scope, impacting confidentiality and integrity, while availability remains unaffected.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00273 · 18.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-09-09T02:09Z
EPSS history
Timeline
  • 09 SEP 02:09Z
    Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management
    cvelistv5