Sap Netweaver Application Server Abap (Applications Based On Sap Gui For Html)

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_(applications_based_on_sap_gui_for_html):*:*:*:*:*:*:*:*

part: a version: * update: *

VendorSap Se (f8f3f5db-c060-5230-a8bd-f91674203607)
ProductSap Netweaver Application Server Abap (Applications Based On Sap Gui For Html) (a324305f-aff5-58b8-ae4d-ec4a0e028f99)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-26659 vulnerable 2026-06-08 07:14:49.948065 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
MEDIUM (6.1)
SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability
Published: 2025-03-11T00:36:40.932Z
Updated: 2025-03-11T14:14:36.613Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-26653 vulnerable 2026-06-08 07:14:49.940599 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
MEDIUM (4.7)
SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page, the injected script gets executed, potentially compromising the confidentiality and integrity within the scope of the victim�s browser. Availability is not impacted.
Published: 2025-04-08T07:10:34.185Z
Updated: 2025-04-08T15:58:31.620Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-0059 vulnerable 2026-06-08 07:00:29.210902 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
MEDIUM (6)
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
Published: 2025-01-14T00:09:07.029Z
Updated: 2025-01-14T14:59:54.719Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33665 vulnerable 2026-06-08 05:32:12.056870 Details available
MEDIUM (5.4)
SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Published: 2021-06-09T13:33:13.000Z
Updated: 2024-08-03T23:58:21.921Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.