What’s Vulnerable › Vulnerabilities

CVE-2025-42948: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-12 · updated 2026-06-17
• Weakness: CWE-79

Description

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim�s browser.

Affected products

• SAP_SE SAP NetWeaver ABAP Platform: S4CRM 100, 200, 204, 205, 206, S4CEXT 107 (+4)

References

• https://me.sap.com/notes/3629871
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42948 or the next vulnerability affects your stack