CVE-2025-42990CWE-79

HTML Injection in Unprotected SAPUI5 applications

Low · published June 10, 2025

CVSS v3.1
3.0
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00221 · 12.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-10T00:12Z
EPSS history
Timeline
  • 10 JUN 00:12Z
    HTML Injection in Unprotected SAPUI5 applications
    cvelistv5