CVE-2025-42985

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality and integrity, with no impact on application availability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429864.3Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could CVE-2025-429874.3SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the CVE-2025-429885.3Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints CVE-2025-429899.6RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On CVE-2025-42999.8A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of CVE-2025-429903.0Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redir CVE-2025-429914.3SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to dele CVE-2025-429926.9SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to expl CVE-2025-429936.7Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Bind CVE-2025-429947.5SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation i CVE-2025-429957.5SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the CVE-2025-429965.6SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticat