DOM-based XSS Vulnerability in SAP NetWeaver Application Server ABAP

CVE-2025-26659

Summary

The SAP NetWeaver Application Server ABAP contains a security issue where insufficient encoding of user-controlled inputs can be exploited, allowing for DOM-based Cross-Site Scripting (XSS) attacks. This vulnerability permits an unauthorized attacker to craft a harmful web message that takes advantage of the WEBGUI functionality. If exploited, the malicious JavaScript code executes within the victim's browser, which may lead to data compromise or manipulation of web content. Though the impact on confidentiality and integrity is limited, users remain at risk if this vulnerability persists.

References