CVE-2025-42948

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim�s browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver ABAP Platform	S4CRM 100; 200; 204; 205; 206; S4CEXT 107; 108; 109; BBPCRM 713; 714

References

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429494.9Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restric CVE-2025-42954.6Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B CVE-2025-429509.9SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC CVE-2025-429518.8Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invok CVE-2025-429527.7SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structur CVE-2025-429538.1SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of pri CVE-2025-429542.7SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function CVE-2025-429553.5Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted req CVE-2025-429566.1SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make pu CVE-2025-429579.9SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the CVE-2025-429589.1Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized CVE-2025-429598.1An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system mis