CVE-2026-0489

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthenticated attacker to inject specially crafted input which upon user interaction could result in a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue had a low impact on the confidentiality and integrity of the application with no impact on availability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SAP_SE	SAP Business One (Job Service)	B1_ON_HANA 10.0; SAP-M-BO 10.0

References

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-04907.5SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks t CVE-2026-04919.1SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. Thi CVE-2026-04928.8SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user po CVE-2026-04934.3Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute stat CVE-2026-04944.3Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would CVE-2026-04955.1SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which CVE-2026-04966.6SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) witho CVE-2026-04974.3SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This CVE-2026-04987.2SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module expose CVE-2026-04996.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-05008.8Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker co CVE-2026-05019.9Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could ex