CVE-2025-0054

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-00556.0SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administratiCVE-2025-00566.0SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�CVE-2025-00574.8SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin caCVE-2025-00586.5In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resourceCVE-2025-00596.0Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usaCVE-2025-00606.5SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which canCVE-2025-00619.1SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without CVE-2025-00624.7SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is thCVE-2025-00638.8SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to CVE-2025-00646.5Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with CVE-2025-00657.8Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for WindowsCVE-2025-00668.8Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restric