Stored Cross-Site Scripting in SAP NetWeaver Application Server ABAP

CVE-2025-26653

Summary

The vulnerability in the SAP NetWeaver Application Server ABAP arises from insufficient encoding of user-controlled inputs, leading to the risk of Stored Cross-Site Scripting (XSS). This flaw allows attackers to inject malicious JavaScript into web pages, potentially targeting users who visit the compromised sites. Upon accessing the affected page, the script executes within the context of the victim’s browser, which can jeopardize sensitive information and user interactions, although system availability remains unaffected.

References