What’s Vulnerable › Vulnerabilities
CVE-2025-27434: Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-11 · updated 2026-06-17
- Weakness: CWE-79
Description
Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.
Affected products
- SAP_SE SAP Commerce (Swagger UI): COM_CLOUD 2211
References
Get alerted when CVE-2025-27434 or the next vulnerability affects your stack