CVE-2025-42942CWE-79

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP

Medium · published August 12, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-12T02:05Z
EPSS history
Timeline
  • 12 AUG 02:05Z
    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP
    cvelistv5