What’s Vulnerable › Vulnerabilities

CVE-2025-42973: Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-08 · updated 2026-06-17
• Weakness: CWE-79

Description

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the affected page. This results in a limited impact on the confidentiality and integrity of user session information, while availability remains unaffected.

Affected products

• SAP_SE SAP Data Services (DQ Report): SBOP_DS_MANAGEMENT_CONSOLE 4.3, 2025

References

• https://me.sap.com/notes/3606103
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42973 or the next vulnerability affects your stack