CVE-2025-42945CWE-94

HTML Injection vulnerability in SAP NetWeaver Application Server ABAP

Medium · published August 12, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or its manipulation. There is no impact on availability.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-08-12T02:05Z
EPSS history
Timeline
  • 12 AUG 02:05Z
    HTML Injection vulnerability in SAP NetWeaver Application Server ABAP
    cvelistv5